The Blind Wall
The detections that cannot fire — each with its dead dependency, its real last-data timestamp, and an exposure grade. To a "no alerts" dashboard these look identical to healthy. Backstop is the difference between the two silences.
● SAMPLEConnecting…
0
Detections
0
Healthy
0
Blind
0
Aging
…
Health states without a real timestamp
Live flip — kill a feed, watch a green light go blind
C2 Beacon — Periodic Egress
depends on sourcetype=paloalto_traffic · window -2m
no data yet — start the feed to bring it alive
feed silent
The feed runs on a real heartbeat into backstop_demo. Stop it and the detection flips because now − last(_time) crosses its real -2m window — not because anything was asserted. Click the light for the query; re-measure it in your own search bar.