Detection Debt

What stops being detected when a telemetry source goes away? No document holds that answer. It exists only by walking the dependency chain and subtracting what is left.

connectorlog tabledetection ruleATT&CK techniquewhat survives

Your question

Enter to send, Shift+Enter for a new line

What it queried

Every call, and which of the two Context endpoints served it. An answer about absence is only worth as much as your ability to check it.

Nothing yet. Ask something and the queries appear here.

The agent reads a Sanity dataset through two Sanity Context endpoints: one in GROQ mode over the live content graph, one in Knowledge Base mode over an index built from the CIS Microsoft 365 and Azure Foundations Benchmarks and Microsoft Learn. Sanity project 6qz0b6rp, dataset production. The content model is browsable at detection-debt.sanity.studio.

Connectors, log tables, rule logic, ATT&CK techniques and baseline controls come from real sources — the Microsoft Sentinel community repository, the MITRE ATT&CK STIX bundle, and the benchmark PDFs. Four fields on each rule do not: status, fpRate, lastValidated and ownerTeam are generated from a hash of the rule id, so the demo is stable between runs. The agent is instructed to say so whenever one of them drives an answer.