Data disparity between SEPM syslog output and EDR/ICDx output