wtf is deadair?

Deadair is a command line tool that checks whether the detection rules in your security monitoring system (called a SIEM) are actually able to see the data they are supposed to watch. It works with Elastic Security and OpenSearch Security Analytics, the two backends it currently supports. A security team turns on detection rules to catch things like suspicious logins or unusual network activity. Each rule is written to look at a certain kind of log data, described as a pattern such as winlogbeat-*. Over time, teams rename data sources, migrate to new systems, or stop collecting certain logs, and a rule can keep running while quietly having nothing left to check. Deadair connects to your SIEM with a read-only credential, reads the list of enabled rules, reads which data sources actually exist and how fresh they are, and matches rules to sources. It then reports gaps: rules with no matching source at all, rules where the matching sources are empty or too old to be useful, sources that exist but have no rule reading them, and cases where the incoming data has fields the rule expects but the source no longer provides. It does not install an agent inside the SIEM and does not write anything to the monitored cluster, so it can run alongside existing tooling without changing configuration. Setup involves downloading a binary or installing it with a Go command, then running a setup step that prints the minimal read-only role needed, a check step to confirm the connection, and a scan step to produce the first report. Reports come as terminal output, JSON, or an HTML page, and a redact flag can replace sensitive names with stable placeholders before the report is shared with anyone outside the security team. Deadair also supports state files to track scan history over time, schema drift detection, and a downtime file so planned maintenance windows do not get flagged as problems. It is aimed at security operations teams and detection engineers who want an outside check that their alerting rules are still connected to live, current data rather than assuming they are.