Changed fields
Inspect synchronized values before and after the selected window.
Change intelligence
Understand what changed, not only what exists.
Time Machine turns synchronized Azure state into a reviewable timeline.
Compare snapshots, inspect property movement, retain removed-resource context, and connect state changes to activity and downstream signals.
- Snapshot comparison
- Property diffs
- Removed-resource history
- Activity context
Change intelligence is designed for investigation and review. It helps teams reconstruct synchronized estate movement; it does not claim to replace Azure activity logs, configuration policy, observability, or an infrastructure-as-code source of truth.
Start with a window
Operating practiceDefine the before, the after, and the scope.
A useful change review begins with two retained states and a bounded set of resources. Lineage keeps that review window visible so operators can distinguish synchronized state movement from assumptions about causality.
- 01
Scope
Choose tenant, subscription, grouping, or resource context.
- 02
Window
Select retained points in time that bracket the event.
- 03
Question
State the incident, drift, or review hypothesis being tested.
Time Machine
Implemented capabilitySee additions, removals, and changed state together.
The comparison view summarizes movement between selected snapshots, then lets reviewers narrow into affected resources instead of manually reconciling exports.
- Added and removed resource context
- Changed-resource summaries
- Consistent selected review window
Configuration movement
Implemented capabilityInspect the properties behind the change count.
Resource-level diffs expose synchronized property changes between selected states. Reviewers can focus on the field movement that matters and carry the evidence into a broader incident or governance review.
Resource focus
Keep the affected asset in view while reviewing its movement.
Review evidence
Use the diff as supporting context, not automatic proof of cause.
Correlated context
Implemented capabilityPlace state movement beside recorded activity.
Timeline and Activity Feed views help an investigator compare state transitions with available Azure activity records. Identity and automation context can clarify who or what acted when the approved sources provide it.
- Chronological state events
- Available activity records
- Identity or automation context from configured sources
Connected intelligence
Implemented capabilityTest whether cost, risk, or ownership moved with the change.
From a change investigation, operators can examine cost movement, recommendations, threat context, and assigned work. The product connects evidence for review but leaves conclusions and remediation decisions with accountable operators.
Cost
Check whether spend movement aligns with the review window.
Risk
Review findings and recommendations around affected resources.
Ownership
Assign follow-up and preserve the decision trail.
Service and advisory
Service and advisoryUse Lineage inside a defined incident or drift review.
Swaves can facilitate a bounded review, help identify source gaps, and structure the resulting evidence pack. Root-cause conclusions still depend on source quality, retention, and expert validation; the service does not manufacture missing telemetry.
- Agree the event window and evidence standard
- Document source gaps and confidence limits
- Return findings, owners, and recommended next checks
Evaluate Lineage
Bring a recent Azure change window.
Use a concrete before-and-after question to evaluate snapshot history, activity context, and review output.