How Kumo.io describes a change

Kumo.io compares snapshots of your workspace, not live events from your cloud. Each difference it finds becomes a change with:

• Severity: Info, Low, Medium, High or Critical.
• Category: structural, configuration, exposure, reliability, security, cost, ownership, or desired vs actual.
• Subject: what changed: a resource, connection, workspace, source, environment, view or policy.

Because Kumo.io only knows when a sync saw a difference, change times are times it was observed, not the moment someone changed your cloud.

Each sync is analysed automatically, except a source's first sync. Earlier snapshots may not have been analysed, so an older period can look unchanged simply because nobody has analysed it yet.

The Changes feed

Open Changes in the sidebar and pick a Workspace. You'll find the same feed on a workspace under Activity, then Changes.

Narrow the feed with:

• Severity: tick one or more levels. Only the levels you tick are shown.
• Category and Subject.
• When: All time, Last 24 hours, Last 7 days or Last 30 days.
• Sort: Newest first or Most severe first.
• Filter changes: free text matched against titles, summaries, kinds, resources and tags.

The feed loads a page at a time; the line above it says how many changes are loaded and whether more are available, rather than claiming a total. The free-text filter only searches the changes already loaded.

Expand a change to see why Kumo.io flagged it, in sections: Cause, Impact, Severity, Confidence, Evidence and Warnings.

Analyse recent changes

If a period hasn't been analysed, choose Analyze Recent Changes to classify it now.

Digest

Choose Digest for a summary of recent changes. Pick the kind of digest: Daily, Weekly, Security or Cost.

Compare two snapshots

To see exactly what differs between two snapshots of a workspace:

• From a diagram, choose Compare in the toolbar.
• From a workspace, open Inventory, find the snapshot under Snapshots, and choose Compare With Previous.
• From a resource's Changes section, compare two snapshots of that resource.

The comparison page shows the pair as From (Older) and To (Newer), and always reads forward in time, whichever side you started from. Choose a different snapshot from the list to change the pair. It shows:

• counts of added, removed and changed Resources and Connections;
• By Severity and By Category breakdowns;
• the list of changes, with Filter Changes and a page size;
• a visual diff of the two diagrams, opened on request.

One resource's history

A resource's page has a Changes section that answers two questions: how this resource changed over time, and what differs between two of its snapshots. See How do I find a resource?

Get told about changes

To be told when an important change happens instead of checking the feed, set up an alert rule on infrastructure changes. See How do I get told when something important changes?

From the CLI

On a self-hosted installation, run these on the installation:

kumo changes compare --workspace <id> [--from <revision-id>] [--to <revision-id>] [--force]
kumo changes comparison show [--artifact <id>]
kumo changes comparison list [--artifact <id>] [--severities high,critical] [--categories <list>] [--kinds <list>] [--text <text>]
kumo changes comparison explain --change <id> [--artifact <id>] [--depth summary|evidence|full]
kumo changes comparison export [--artifact <id>] [--export-format json|csv]

• changes compare compares two revisions and saves the result. Without --to it uses the latest revision; without --from, the one before it.
• The comparison commands work on a saved comparison. Without --artifact, they use the latest comparison for the current workspace.

comparison show, comparison list and comparison explain also work against kumo.io from your own machine with an API token. See the CLI reference.

Which plans include change analysis

Change analysis and snapshot comparison are part of the Business and Enterprise plans on kumo.io (and the Business trial), and of Enterprise (Licensed) on a self-hosted installation. They aren't part of Team. See What does each plan include?

On a plan without them, the Changes screen shows a lock instead, which explains why and opens the plan options.