It will not tell you you're safe
There's exactly one thing this tool will tell you.
These files changed, by this much, in this window.
Rules only catch what someone already hit
Detection rules come from attacks someone already survived. A new technique is, by definition, not in them.
When rules render verdicts, whatever they miss gets painted as "all clear".
That happened to us. We searched by filename, missed the same payload under a different name, and the screen said zero. We believed that screen for a while.
A zero means four different things
A zero on screen can be any of these four, and they are not the same thing.
No activity
Nobody touched it in that window. There is nothing to compare.
No changes
There were pushes, but the contents are unchanged.
Could not check
A lookup failed, so we can't claim anything either way.
No rule matched
It changed, and nothing flagged it. Someone still has to read it.
Collapse those four into one zero and the third one reads as the first. That is where a tool starts lying to you.
What that rules out
Nothing is ever red
Colour doesn't hand down verdicts either. There is no red in the interface.
Levels are not severity
A signal carries attention, not risk. Not how dangerous it is, but how soon you should look at it.
Failures stay on screen
Anything unverified is counted and shown where you can't miss it. Swallowing it quietly is how you end up reassured about nothing.
Zero signals still leaves a full list
Every changed file is listed whether a rule matched it or not. Rules only set the order.