Work down this list:
1. Format. Mode 2 wants CSV, JSON, or Parquet. Mode 1 templates are Excel/CSV for assets, not event dumps.
2. Mapping. Is at least one mapping enabled? Has it ever observed a match?
3. Stream. For Mode 3, is the stream `active`? When was `last_received_at`?
4. Entitlement. Is the daily ingest meter at or over 100%?
5. Trial. Free-plan trial expiry blocks engine writes.
Silence (no rollups, no Spike fires) is Unknown coverage, not proof that risk decreased.
Still stuck? Email [email protected] with the Mode (1/2/3), approximate time (UTC), and Asset id — not raw log bodies.