deadair catches SIEM rules that run but are blind to their own telemetry
A rule can be enabled, error-free, and useless if the data it queries is gone. deadair is a read-only CLI that checks Elastic and OpenSearch rule inventories against live telemetry, flagging rules with no matching source, stale or empty data, missing fields, and ingest-lag blind windows. Outputs terminal, JSON, HTML, and Prometheus metrics.