list_drift_events
Identify configuration drift between scans by listing changed fields with old and new values for change tracking.
Instructions
[READ] List configuration drift events from the most recent scan snapshot — fields whose values changed since the prior scan of the same target. limit (optional int, default 50): maximum rows returned, ordered by node_id then field; no offset/cursor. Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {node_id, field, old_value, new_value, detected_at}. total is the snapshot's exact change-event count, so truncated tells you definitively whether rows were left behind — raise limit when it is true. Returns an empty envelope (total 0) when no snapshot exists or there was no prior snapshot to diff against (a target must be scanned at least twice). Read-only query of the local twin DB (~/.vmware-harden/twin.duckdb); no network calls. Use for change tracking; use list_violations for compliance failures.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |