Concord engine vocabulary
Drift Detection
Streaming statistical tests on input, output, and schema-shape that catch silent vendor changes before they break detection coverage.
Definition
Drift Detection inside Concord by IaxaI watches three channels on every live source: the input distribution of raw events, the output distribution of post-translation OCSF events, and the schema-shape, the field-path set seen on incoming events. A streaming Maximum Mean Discrepancy test fires when input or output distributions move beyond their reference window. A schema-shape mismatch fires when a vendor renames or reshapes a field. Drift on any channel is correlated against the others within a 15-minute window so a single root-cause vendor change surfaces as one event, not three. The detection itself is cheap, deterministic, and lives in the hot path. Repair runs on a separate worker. Static mappings rot quietly when vendors push silent updates; drift detection turns the silent failure mode into a loud, ledgered, reviewable event before detection coverage gaps reach an audit. Patent candidate, in development.
See also
Related capabilities and terms
Maximum Mean Discrepancy (MMD)
A kernel-based two-sample test for whether two batches of data come from the same distribution. The drift detector's primary statistic.
Auto-Repair (self-healing pipeline)
When drift fires, Concord proposes a new mapping, runs it in shadow, calibrates it, and only promotes after operator approval. Every step is ledgered.
Schema Drift
When a vendor silently renames or reshapes a field. The failure mode that quietly breaks every static mapping in your stack.
Universal Adapter
The connectivity layer that ingests events from any source and hands clean, canonical OCSF events to the rest of the engine.
Stop reconciling. Start trusting one timeline.
30-minute walkthrough. Your tools. Your tenants. Your audit cycle. We will show you exactly where Concord earns its keep.