Start with the visible facts
- Confirm the correct customer, organization, source, and environment scope.
- Record the current state, last successful collection, and first failure time.
- Check for planned maintenance, provider incidents, network controls, and recent role or credential changes.
- Compare the approved scope with what the provider identity can currently read.
- Keep the exact visible error, but remove secrets and sensitive addresses before sharing it.
Common causes
- Access denied
- The connection identity no longer has an approved permission, resource scope, or trust relationship.
- No recent evidence
- The source may be delayed, empty for the selected scope, rate limited, or unable to complete collection.
- Partial collection
- Some scopes or records succeeded while others failed, were excluded, or reached a provider limit.
- Connection unavailable
- A provider incident, network control, invalid endpoint, expired trust, or unsupported change may block communication.
Escalate safely
Contact Hansec Support when the source remains unhealthy after approved provider checks, when evidence is incomplete without a clear reason, or when the problem affects a time-sensitive security decision. Include impact, scope, times, last successful collection, recent changes, and the sanitized error. Never include passwords, access keys, tokens, private keys, or recovery codes.