Drift detection

Drift detection compares the sha256 of a predefined set of config files against a hub-side baseline. Any change that didn’t happen within 5 minutes of an Emergency Action Token (EAT) is flagged as drift.

Default watched paths

Agent v1823+ hashes these 8 paths on each 6-hour inventory cycle:

/etc/nginx/nginx.conf
/etc/postgresql/main/postgresql.conf
/etc/postgresql/main/pg_hba.conf
/etc/ssh/sshd_config
/etc/sudoers
/etc/sudoers.d/monsys
/etc/systemd/system/monsys-agent.service
/etc/caddy/Caddyfile

Operator override via tenant_settings.drift_watched_paths.

Trust Score integration

configuration_drift is a 15%-weighted component in Trust Score. Penalty: -10 per unauthorised drift event in the last 30 days.

Agents on binary < v1823 → component blanked with UI hint.