Skip to content
Daniel TorresConnect

Case study 05 · Network drift and port compliance console

PPSM Delta Analysis Console

Find the registered assets that went dark, and the ports that drifted from the baseline.

Four analysis jobs · local processing

Film shows the console on a synthetic baseline of 172 assets on private addresses.

01Program challenge

Registered assets stop responding between weekly scans, open ports drift from the approved PPSM baseline, and asset records collide. Each of those checks was a separate spreadsheet exercise.

An asset that is in the authorized baseline but no longer answers on the network, or a port that was never approved, is a gap between what the package says and what is running.

02Leadership decision

Requirements
Built around the hardware, software and PPSM exports the security manager requests, and the quarterly hardware validation process between assessment and the CMDB team.
Stakeholders
The security manager, the CMDB and hardware audit team, and network engineering.
Trade-off
Kept everything local in the browser rather than connecting to the scanner or CMDB directly, avoiding new interfaces that would need their own approval.

Key decisions

One console, separate jobs

Each job opens in its own tab with its own inputs, so an analyst runs only what the week requires.

Trend over snapshot

Prior weeks can be added so the console reports whether drift is getting better or worse, and flags consecutive weeks of worsening for escalation.

Tolerate real-world exports

Auto-detected column mapping with manual override handles the variations between scan tools and baseline templates.

03Engineering solution

  • A mission-select console with four jobs: Dead IP Drift, Port Compliance Audit, PPSM IP Delta and Duplicate Assets.
  • Dead IP Drift cross-references weekly dead IP reports against the hardware baseline with risk tiering, SLA countdowns and a weekly trend.
  • Analyst notes and dispositions per asset, POA&M drafts, a SITREP, an executive report and Excel exports.
  • Column mapping that auto-detects headers and accepts manual overrides, plus saved sessions.
  1. Step 1

    Pick the jobs for this week

  2. Step 2

    Load the baseline and scan reports

  3. Step 3

    Run the analysis and review the trend

  4. Step 4

    Disposition assets and export the SITREP or POA&M draft

04Operational impact

Matched drift, dead IPs not in the baseline and the full baseline status in one view, with the riskiest assets tiered first and SLA clocks visible.

The SITREP and executive report give the same analysis to leadership without extra work.