drift_report
Detect endpoints that deviate from a per-field baseline, such as patch level or OS build. Derives baseline from fleet majority when omitted, supporting compliance analysis.
Instructions
[READ] Report endpoints drifted from a per-field baseline (patch/agent/OS/profile).
Answers "which endpoints have drifted from the fleet?" With no baseline it derives one by fleet majority (the most common value per field is treated as intended), so it works before any gold image is declared. Pass 'endpoints' for pure analysis, or a target to pull live inventory.
Args: baseline: Field→intended-value map; omit to derive the fleet majority. fields: Inventory fields to check (default agentVersion, patchLevel, osBuild, profileId). endpoints: Injected inventory rows; skips live collection. target: Endpoint-management target name from config; omit for the default.
Returns dict: {totalEndpoints, baselineSource, baseline, fieldsChecked, driftedCount, compliantCount, driftByField, driftedEndpoints[], truncated}.
Example: drift_report(endpoints=[{"hostname":"tc01","patchLevel":"2026-06"}, {"hostname":"tc02","patchLevel":"2026-05"}]).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| fields | No | ||
| target | No | ||
| baseline | No | ||
| endpoints | No |