deadair

deadair 检查已启用的 SIEM 检测是否仍具备所需的遥测数据。 它会报告缺失或过期的数据、摄取延迟以及模式不匹配。 本地运行 · 只读 · 无代理 · 不上传遥测数据 阅读技术文章 · 入选 Detection Engineering Weekly · 入选 tl;dr sec 341 一次性 Elastic 实验环境中的缺失字段和延迟事件。打开图片可查看带播放控件的简短录屏，或使用 make record-scan-lab 复现。 为什么选择 deadair 一条规则可能在所需数据消失后仍处于启用、已调度且无错误的状态。deadair...

deadair v0.8.0

deadair checks whether enabled SIEM detections still have the telemetry they need. It reports missing or stale data, ingest delays, and schema mismatches. Runs locally · Read-only · No agent · No telemetry upload Read the technical write-up · Featured in Detection Engineering Weekly · Featured in...

deadair v0.6.0

Open-source SIEM detection health. Find enabled detections that are blind because their telemetry is missing, stale, late, or schema-incompatible. Runs locally · Read-only · No agent · No telemetry upload Read the technical write-up · Featured in Detection Engineering Weekly Real scan of a...

deadair v0.5.1

Open-source SIEM detection health. Find enabled detections that are blind because their telemetry is missing, stale, late, or schema-incompatible. Runs locally · Read-only · No agent · No telemetry upload Read the technical write-up · Featured in Detection Engineering Weekly Real scan of a...

deadair v0.4.0

Open-source SIEM detection health. Find enabled detections that are blind because their telemetry is missing, stale, late, or schema-incompatible. Runs locally · Read-only · No agent · No telemetry upload Read the technical write-up · Featured in Detection Engineering Weekly Real scan of a...