Concepts
Evaluation mode
Evaluation mode is an opt-in synthetic tenant for exploring the console without live SIEM credentials. It is labeled in the UI. It must never backfill a failed live API call — that rule is part of custody, not a convenience feature.
Why evaluation exists
Design partners, new operators, and internal demos often need to click through Incidents, Automation, Workspace, Infrastructure Map, and domain workbenches before Sentinel or Defender credentials are configured. Waiting for a perfect live tenant blocks that exploration.
Evaluation mode provides a coherent synthetic dataset: connectors, members, incidents, and related records share stable identifiers and explicit synthetic provenance. The point is to learn the console’s shape and workflows — not to pretend a production tenant is healthy.
Rules the product is expected to enforce
These rules matter most when something goes wrong. A control plane outage must not look like a quiet, healthy SOC because evaluation fixtures quietly filled the gap.
- Synthetic provenance remains on evaluation records and stays visible
- Live mode that cannot reach the API shows empty or unavailable states with a plain reason
- Evaluation data is not injected when a live fetch fails
- Banners and badges identify evaluation operations so operators are not misled
- Hunt Ledger follows the same honesty rule: unavailable means unavailable — no synthetic overnight run is substituted
Where you will see it
Command Center can switch between live incident load and evaluation data. Incidents, Automation, Infrastructure Map, domain overviews, and several Workspace sections behave similarly: evaluation unlocks interactive exploration; live mode stays honest when the control plane is down.
Some Workspace scaffold controls (security posture drafts, billing contact, reporting schedules) mutate session-local state in evaluation. That is intentional for exploration. It is not a substitute for tenant configuration persisted by the control plane.
How to talk about evaluation with stakeholders
Say “synthetic walkthrough tenant,” not “demo of our live coverage.” Say “connectors not configured; evaluation is on,” not “nothing is happening so we must be safe.” Hunt Ledger’s unavailable banner exists precisely so quiet cannot be confused with watched.