Understand the IaC drift detection table

The IaC Drifts page combines triage widgets with a detailed issue table. Use the widgets to identify priority work. Use the table to investigate and reconcile specific drift issues.

Navigate to Application Security > Issues > IaC Drifts.

Widgets

Use the widgets to identify and prioritize the highest-severity issues before opening the detailed table. Selecting a widget value filters the table to matching issues.

Important: The Drift finding type does not receive Urgency classification. Urgency metrics are calculated only for vulnerability, code weakness, IaC misconfiguration, and secret issues. Prioritize drift issues by severity, by the internet exposure of the drifted resource, and by the criticality of the application the resource supports.

Severity breakdown

The histogram widget charts the count of open issues per severity level. For scanner types that do not calculate Urgency, the widget displays a severity breakdown in place of the Urgency breakdown. Read the proportions rather than the absolute counts. A drift issue is raised against a resource that is deployed by definition, so deployment status does not differentiate one drift issue from another. Severity, internet exposure, and application criticality do.

SLA Status

The SLA Status widget groups issues by SLA compliance status.

Insights

Each insight card pairs a severity level with another risk dimension and shows the number of issues matching both conditions. Dimensions include SLA status, internet exposure, application criticality, privileged capabilities, and the cloud account the drifted resource belongs to. unverified — confirm the insight card set rendered on the IaC Drifts page

Note: Every row in the IaC Drifts table represents a live regression. The Drift scanner raises a finding only when the deployed resource violates a security policy that the source template does not violate, so the table contains no code-only or theoretical findings.

IaC Drifts table

The IaC Drifts table provides a consolidated view of drift issues. Each row represents an issue created when a scanner finding matches a unified policy. Each row links both sides of the divergence — the IaC resource that declares the intended state and the deployed cloud resource that departed from that state — along with the repository, the cloud account, and the triggering policy.

The columns in this table are documented in a shared reference. For descriptions of every available column, the attributes common to all code scan issue tables and the attributes specific to this issue type, see Issue table attributes reference.

Filter and sort the table

Use the filter bar at the top of the IaC Drifts table to narrow results by any filterable column. Apply the following strategies to scope the table to a working set.

Strategy	Filter	Use when
Focus on impact	Severity set to Critical and High	You are establishing the initial working set for a reconciliation cycle
Focus on public exposure	Internet Exposed set to True	The drifted resource accepts traffic from the internet, so the weakened control is externally reachable
Scope to one cloud account	Cloud Account set to a single account	One team owns one account, and you are routing reconciliation work by ownership
Scope to one repository	Repository set to a single value	You are reconciling an entire declared-state baseline in one pass
Separate untriaged from active work	Resolution Status set to New, then to In Progress	You are measuring triage backlog against reconciliation throughput
Identify recent out-of-band changes	Created sorted descending	You are detecting an active pattern of changes applied outside of Git rather than reviewing a historical backlog

Note: Filtering scopes the population; sorting orders it. Apply both. Sorting by Created descending is the primary drift-specific ordering, because a cluster of recent drift issues in one account indicates a process failure rather than a set of independent defects.

Manage issues

Right-click a row in the IaC Drifts table to access the following actions.

Action	Description
Change Status	Modify the resolution status of the issue. Values: New, In Progress, Resolved
Change Severity	Modify the severity level of the issue. Values: Critical, High, Medium, Low
Change Assignee	Change the user or identity assigned to address the issue
Copy text to clipboard	Copy the selected cell text
Copy entire row	Copy the full row of data
Copy issue URL	Copy the URL of the issue, to share or reference the issue
Show/hide rows with the severity level	Show or hide all rows matching the severity level of the selected row

Important: Resolving a drift issue requires a reconciliation decision in one of two directions. Either update the template to record an intentional change, or revert the deployed resource to the declared state. Setting the status to Resolved without reconciling one side leaves the divergence in place, and the next scan raises the drift again.