list_drift_events
Shows configuration drift events from the latest scan, highlighting fields that changed compared to the previous scan. Use for change tracking.
Instructions
[READ] List configuration drift events from the most recent scan snapshot — fields whose values changed since the prior scan of the same target. limit (optional int, default 50): maximum rows returned, ordered by node_id then field; no offset/cursor. Each event is {node_id, field, old_value, new_value, detected_at}. Returns [] when no snapshot exists or there was no prior snapshot to diff against (a target must be scanned at least twice). Read-only query of the local twin DB (~/.vmware-harden/twin.duckdb); no network calls. Use for change tracking; use list_violations for compliance failures.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |