3033 event without associated 3077 event

[iainfm]

Hi,

We've been trying to use the advanced hunting log to create a policy for an application. However, some binaries that are being caught by CI as not meeting enterprise signing requirements as a 3033 event (AppControlCodeIntegrityOriginBlocked) but without an associated 3077 event. As a result they're not getting included in the KQL results.

Just wondering if anyone knows why this might be, and how to capture the details for policy creation centrally (we can remote-admin the machine in question, so can just scan manually for now).

Many thanks,
Iain