drift_report
Identifies endpoints that have drifted from a per-field baseline for patch, agent, OS, or profile. Derives fleet majority baseline if none is provided, and supports analysis with injected inventory or target.
Instructions
[READ] Report endpoints drifted from a per-field baseline (patch/agent/OS/profile).
Answers "which endpoints have drifted from the fleet?" With no baseline it derives one by fleet majority (the most common value per field is treated as intended), so it works before any gold image is declared. Pass 'endpoints' for pure analysis, or a target to pull live inventory.
Args: baseline: Field→intended-value map; omit to derive the fleet majority. fields: Inventory fields to check (default agentVersion, patchLevel, osBuild, profileId). endpoints: Injected inventory rows; skips live collection. target: Endpoint-management target name from config; omit for the default.
Returns dict: {totalEndpoints, baselineSource, baseline, fieldsChecked, driftedCount, compliantCount, driftByField, driftedEndpoints[], truncated}.
Example: drift_report(endpoints=[{"hostname":"tc01","patchLevel":"2026-06"}, {"hostname":"tc02","patchLevel":"2026-05"}]).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| fields | No | ||
| target | No | ||
| baseline | No | ||
| endpoints | No |