Sensor was not connected to the server between the period of the event and the time the alert was triggered
Additional Information
The sensor core driver storesĀ up to 12k in memory for events. Events then get rolled to disk during the stop of services. During this, if the memory limit or storage limit are hit, newer events will be dropped.
Utilize the /var/log/cb/nginx/access.log to check when sensor first started to check in. The following command can help. sensorid can be found in the sensor's details page.