Which plans include it

Change analysis is part of the Business and Enterprise plans, and of Enterprise (Licensed) for self-hosted installations. It is also included in the 14-day Business trial that new hosted accounts start with. Team doesn't include it: on Team the Changes feed and revision comparisons are refused.

Two ways to see change

Both start from the same comparison of two revisions, so they agree on what changed.

How changes are classified

Every change gets a severity on one five-level scale: info, low, medium, high and critical. Severity is worked out from what changed, not from how many fields changed. Some examples from Kumo.io's built-in rules:

Changes are also grouped by category. In the Changes feed the categories are structural, configuration, exposure, reliability, security, cost, ownership and desired_vs_actual. Each feed item also carries a confidence, kept separate from severity, so you can tell a serious change Kumo.io is sure about from one it is inferring.

Deletions and coverage gaps

Something missing from a sync isn't always deleted. If a removal happened where the newer revision didn't have full coverage, for example a region the credential could no longer read, Kumo.io reports it as Removal may be a coverage gap at info severity instead of a deletion. Alerts don't treat it as a confirmed deletion either. See Revisions and the timeline.

The Changes feed

Open Changes in the sidebar, under Activity, and pick a Workspace. The same feed is on each workspace's Activity tab.

• Filter by severity, Category, Subject (resource, connection, workspace, source, environment, view or policy) and When (All time, Last 24 hours, Last 7 days or Last 30 days), or type into Filter Changes.
• Sort by Newest first (the default) or Most severe first.
• The feed loads in pages. Select Load More to continue.
• Expand an item to see why Kumo.io flagged it, in sections: Cause, Impact, Severity, Confidence, Evidence and Warnings.
• Digest summarises a period in one of four modes: Daily, Weekly, Security or Cost.

Kumo.io analyses each sync automatically, except a source's first sync: that one would report everything as newly added. Earlier snapshots aren't analysed until you ask. That means an empty feed can mean either "nothing notable changed" or "these snapshots haven't been analysed yet", and the page says so. Select Analyze Recent Changes to find out. With only one snapshot, the feed tells you there is Not enough history to compare.

Comparing two revisions

1. Open a workspace, then Inventory and Snapshots.
2. On any snapshot after the first, select Compare With Previous.
3. On Compare Revisions, use Compare with revision to pick a different revision if you want.

The pair is always shown older to newer, as From (Older) and To (Newer), whichever side you started from. The page shows:

• Counts of changed Resources and Connections, and Total Changes.
• Breakdowns By Severity and By Category.
• Warnings, for example when one of the revisions had partial coverage.
• Every change, filterable with Filter Changes. Expand a change to see each field: the value after for an addition, the value before for a removal, and before and after for a change.
• Show Visual Diff, which draws the change as a diagram: green for added, red for removed, orange for modified or moved.

A resource's own page also has Compare Snapshots, to compare that one resource between two revisions.

Secret values stay hidden

When a changed field's name suggests secret material, such as a password, secret, private key, access key, connection string, token, API key, kubeconfig or certificate, Kumo.io replaces both values with a redacted marker before the comparison is stored. You still see that the field changed. See Redaction and sensitive fields.

Alerts

The comparison Kumo.io makes after each sync is also what alerts are evaluated against, so an alert rule can notify you of high-severity changes by email, Slack or webhook. A comparison you open yourself never fires alerts. See Alerts.

API and command line

The API exposes both views of change under each workspace, /v1/accounts/{accountId}/workspaces/{workspaceId}/:

• graph-diffs creates a comparison of two revisions (POST with from.workspaceGraphRevisionId and to.workspaceGraphRevisionId). Under graph-diffs/{artifactId} you can read its summary, page through its changes, explain one change, and export it as JSON or CSV.
• change-intelligence/changes lists the classified feed, change-intelligence/digest builds a digest, and change-intelligence/resources/{resourceId}/timeline shows one resource's change history.

From the kumo CLI, against kumo.io or a self-hosted installation:

kumo changes comparison show --artifact <comparison-id> --account <account-id>
kumo changes comparison list --artifact <comparison-id> --account <account-id> --severities high,critical
kumo changes comparison explain --artifact <comparison-id> --change <change-id> --account <account-id>

On a self-hosted installation you can also create a comparison and export it:

kumo changes compare --account <account-id> --workspace <workspace-id> --from <revision-id> --to <revision-id>
kumo changes comparison export --artifact <comparison-id> --account <account-id> --export-format csv

See the API reference and the CLI reference.