Skip to main content

Change Detection & Provenance

Snapshot-Based Change Tracking​

The First Watch® platform continuously creates snapshots of assets and their observable states. These snapshots are created specifically to support change provenance, not merely to record events.

From an operational perspective, a snapshot represents a point-in-time description of an asset, including:

  • Configuration and operational state
  • Relevant software, firmware, and logic attributes
  • Observed communication behaviour
  • Associated user or system activity where available

Snapshots are created automatically and continuously, without requiring manual actions from operators.

What Provenance Means in Operations​

In an industrial context, provenance is the ability to reconstruct the full history of a change with confidence.

Operationally, provenance allows teams to answer fundamental questions:

  • What exactly changed?
  • When did the change occur?
  • Where in the system did it happen?
  • Who or what initiated the change?
  • How did the system look before and after the change?

This capability is critical because many industrial issues do not stem from a single obvious action, but from gradual, cumulative, or partially documented changes.

Tracing and Understanding Changes​

By comparing snapshots taken before and after a modification, the platform enables operators to:

  • Identify precisely which parameters, configurations, or behaviours were altered
  • Distinguish expected maintenance activity from unexpected or unauthorised change
  • Correlate changes with maintenance windows, alarms, or operational events
  • Reconstruct the sequence of changes leading up to an anomaly or investigation

Change analysis is therefore based on evidence rather than assumption or recollection.

Operational Use of Provenance​

In day-to-day operations, snapshot-based provenance is used to:

  • Verify that approved maintenance produced the intended outcome
  • Confirm that no additional or unintended changes occurred
  • Support audits, reviews, and compliance activities
  • Accelerate root cause analysis during incidents

Screen illustrations included in this section provide examples of how snapshots and change comparisons are presented within the platform. These visuals are intended to support interpretation of provenance information, not to document user interface procedures.

Snapshot Example​

note

Snapshot screenshot to be added.

Asset Change Events​

note

Asset change events screenshot to be added.