Drift Detection

Drift detection is BLACKOUT's continuous monitoring capability. It alerts you when vendor behavior changes from your established baseline.

What is Drift?

Drift = Any change from your baseline scan.

When you first scan a site, BLACKOUT establishes a baseline — the known-good state of your vendor ecosystem. Subsequent scans compare against this baseline to detect:

• New vendors appearing
• Existing vendors disappearing
• Behavior changes (new cookies, endpoints, data collection)
• Consent mechanism changes

Drift Types

Baseline Management

Automatic Baseline

By default, BLACKOUT uses your first scan as the baseline.

Manual Refresh

To update your baseline after intentional changes:

1. Navigate to Sites > [Your Site] > Baseline
2. Click Refresh Baseline
3. Confirm the new baseline scan

Drift Incidents

Multiple related drift events are grouped into incidents:

{
  "incident_id": "DI-2024-001",
  "vendor_id": "hotjar",
  "drift_type": "vendor_behavior_changed",
  "event_count": 3,
  "max_severity": "high",
  "window": "2024-01-15 to 2024-01-17"
}

This prevents alert fatigue from repeated similar events.

Alert Configuration

Slack Integration

// Settings > Integrations > Slack
{
  "webhook_url": "https://hooks.slack.com/...",
  "channel": "#security-alerts",
  "severity_threshold": "medium"
}

Email Digest

• Daily: Summary of all drift events
• Weekly: Trend report with recommendations
• Immediate: Critical drift only

Responding to Drift

When drift is detected:

1. Review the drift event details
2. Investigate what changed and why
3. Decide:
   • If intentional → Update baseline
   • If unauthorized → Escalate + remediate
4. Acknowledge the drift event
5. Document your decision for audit trail

Drift Dashboard

The SOC workspace shows:

• Unacknowledged drift count
• Drift by severity (chart)
• Recent drift timeline
• Sites with most drift

Best Practices

1. Monitor weekly at minimum
2. Acknowledge promptly — don't let alerts pile up
3. Update baselines after marketing changes
4. Set severity thresholds appropriate to your risk tolerance
5. Document decisions for compliance audits

Next Steps

• Evidence Packs — Export drift evidence
• Workspaces — Configure SOC view for triage