My knowledge base missed a contradiction. My content graph found it in one query
This is a submission for the Sanity Challenge, Path One: Ship an Agent That Queries Real Content What I Built Detection Debt answers a question a security operations team cannot look up: if this telemetry source goes away, which detections die and which MITRE ATT&CK techniques stop being watched? No document holds that answer. It exists only by walking connector → logTable → detectionRule →…
This submission for the Sanity Challenge showcases an agent that queries real content to answer security operations questions about detection debt. The author built a Sanity Knowledge Base by feeding CIS benchmark PDFs and Microsoft Learn pages, then modeled those same claims as documents in a Sanity dataset. When asked about password length for a break-glass account, the knowledge base returned conflicting answers according to its corpus.
Meanwhile, the dataset graph returned both answers in one query. The post explains how the detection debt manifests, from which ATT&CK techniques stop being watched if a telemetry source is lost to gaps in covered Credential Access techniques. One question the tool can answer is which detection coverage is missing if a component like Defender for Endpoint is taken away.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
