Deltas

When something changes, what did it do?

A Delta watches a system for changes: a policy update, a release, a config edit, a vendor patch. After each one it compares behaviour with the 30 days before, so you see what the change was meant to do and what it quietly broke.

Try PanapticoExplore the platform

Delta · watching Intune

When device policy changes, what did it do?

1 effect caught

Compliance policy updated

Oct 29, 15:04

Minimum OS raised, legacy VPN profile removed. 214 laptops in scope.

Should changeConfirmed

Laptops pick up the new policy

Must keep workingHeld

Microsoft 365 sign-ins don't drop

Must keep workingCaught

VPN still connects for remote staff

Must keep workingHeld

Help desk tickets don't spike

Caught

VPN still connects for remote staff

−38%

VPN sessions per hour. 3 remote laptops connected before the change and fail since.

Outcomes

Each effect gets an outcome.
Against its own normal.

Every change is judged on the effects you declared: what it should change, and what must keep working.

Confirmed

An effect the change was meant to have, and it happened.

Held

Something that had to keep working, and it did, inside its normal band.

Caught

Something that had to keep working and stopped. The change, the affected items, and the before and after are kept.

Gone or new

Items that disappeared or appeared after the change, flagged for a person to judge.

How a Delta works

Normal is the 30 days before.
Not a threshold someone guessed.

Deltas compare like with like: the same measure, the same scope, before and after each change.

  1. 1Watch

    Pick what changes

    A system's change log: policy updates, deployments, configuration edits, vendor releases.

  2. 2Declare

    Name the effects

    What should change, and what must keep working. Each effect has a measure and a scope.

  3. 3Compare

    Before and since

    After each change, every effect is measured against its own 30-day normal band.

  4. 4Report

    Outcome per effect

    Confirmed, held, or caught, with the items behind each one and the moment it moved.

Why it matters

Changes are where things break.
Deltas catch it the same day.

Tied to the change

Every caught effect points at the change that preceded it, with its time and author.

Intended and unintended

A change that did its job and broke something else shows both, side by side.

The items affected

Not just a dip in a chart: the exact laptops, accounts, or orders that behave differently since.

Examples

Deltas teams run.
Wherever changes land.

Intune policy changes don't break VPN or sign-in
Workday changes don't break the payroll export
Salesforce releases don't slow quote generation
Oracle patches don't pause scheduled jobs
Firewall rule changes don't cut off a site
Okta group changes don't remove app access

Works with

The rest of the platform.
One record of what's true.

Checks

Test a process against your live systems

Explore Checks

Sweeps

Run the same check across every target

Explore Sweeps

Traces

Verify each run against the expected steps

Explore Traces

Every change, judged.
Against how things worked before.

Point a Delta at a system that changes often. Panaptico compares every change with its own normal.

Try PanapticoRead the docs