[k3mpaxl]

What's missing, for analysts

• Attack impact → What's missing shows the same list agents get from get_gaps.
• Each gap shows:
  • its priority, the question and why it matters
  • the entities it is about (click one to show it in the graph)
  • the table, the platform it runs on (Defender XDR or Sentinel) and the mapping that imports the export
  • Copy and Show query for the KQL
• Nothing found closes a gap for everyone, agents included. It writes the same factgraph:gap/<id> answer source as submit_gap_rows.
• An Answered summary lists answered gaps and inventory exports.
• Once something is marked compromised, the open hunts stay under Hunt next and are not listed twice.

Dropped inventory exports close their gaps

• Before this change, a dropped IdentityInfo, DeviceInfo or OAuthAppInfo export that only added IDs the board already had left no trace. Its who/what gap stayed open.
• The import now writes one factgraph:inventory/… source per export, listing the board entities the export described. boardGaps counts those entities as answered for that table's gap.
• An export that describes nothing on the board records nothing. Importing the same export again records nothing new.

Tests

• Python: the inventory record, no repeat on re-import, nothing recorded when nothing is described.
• web/tests/gaps.cjs: records close identity and app gaps per entity and are not reported as answers.
• New e2e test: the gap list appears, a dropped IdentityInfo export closes the identity gap, and Nothing found closes the app gap, also over REST.
• Run locally: ruff, unittest (77), Prettier, npm test, bench, and the full Playwright suite (33 tests), all green.

Version 0.6.3.

---

Generated by Claude Code