Technical concepts
Schema Drift
When a vendor silently renames or reshapes a field. The failure mode that quietly breaks every static mapping in your stack.
Definition
Schema drift is what happens when an upstream vendor renames a field, splits one field into two, changes a value's type, or adds a key in a point release without telling anyone. Static mapping configurations rot. Detection coverage rots with them. The failure mode is silent: the pipeline keeps running, dashboards keep updating, and the analyst doesn't notice until an audit asks why a particular event class disappeared from the data three months ago. Concord by IaxaI catches schema drift at ingest time. Every event's field-path set is hashed. The hash is compared against the known-good baseline for that source. When the hash diverges (fields added, fields removed, fields renamed), a `schema_drift_event` is recorded and the auto-repair loop is triggered. The proposed new mapping is calibrated against held-out events, runs in shadow against the existing mapping, and only promotes after divergence stays within threshold. Silent failure becomes a loud, ledgered, reviewable event.
See also
Related capabilities and terms
Drift Detection
Streaming statistical tests on input, output, and schema-shape that catch silent vendor changes before they break detection coverage.
Auto-Repair (self-healing pipeline)
When drift fires, Concord proposes a new mapping, runs it in shadow, calibrates it, and only promotes after operator approval. Every step is ledgered.
Maximum Mean Discrepancy (MMD)
A kernel-based two-sample test for whether two batches of data come from the same distribution. The drift detector's primary statistic.
Universal Adapter
The connectivity layer that ingests events from any source and hands clean, canonical OCSF events to the rest of the engine.
Stop reconciling. Start trusting one timeline.
30-minute walkthrough. Your tools. Your tenants. Your audit cycle. We will show you exactly where Concord earns its keep.