Config Drift Detection

Overview

Monitor system configuration and detect changes from baseline. Alert on unexpected modifications.

Why It Matters

Catch changes that bypassed your process. File integrity monitoring.

The Risk

Implementation Components

A complete implementation of this capability includes:

• Baseline configuration defined and stored
• File integrity monitoring (AIDE, Tripwire)
• Daily checks against baseline
• Alerts on unexpected changes
• Integration with config-as-code for authorized changes
• Incident response process for drift

Implementation Pattern

1. 1Define baseline configuration
2. 2Monitor critical files
3. 3Hash and compare configs
4. 4Alert on changes

Pipeline Coverage

This continuous capability monitors and applies to the following pipeline phases:

Tool Examples

These are examples, not endorsements. Choose what fits your context.