# Session Comparison

Source: https://docs.ops0.com/docs/discovery/session-comparison

Compare any two discovery sessions to see exactly what changed in your infrastructure between scans — added resources, removed resources, configuration modifications, cost changes, and security findings.

## When to Use Session Comparison

| Scenario | What to Compare |
|----------|----------------|
| Weekly drift review | This week's scan vs. last week's scan |
| Post-incident audit | Scan taken after an incident vs. before |
| Pre/post migration | Before migrating to IaC vs. after |
| Compliance audit | Current state vs. last audited baseline |
| Cost investigation | Current scan vs. scan from last billing cycle |

---

## Running a Comparison

### Navigate to Discovery Sessions
Go to **Discovery → Sessions** and find the two sessions you want to compare.

### Select Sessions
Use the checkboxes to select exactly two sessions. The comparison button becomes active once two are selected.

### Click Compare
Click **Compare Sessions**. ops0 runs the diff and redirects you to the comparison results page.

### Review Results
The results page breaks changes into categories: Added, Removed, Modified, and Unchanged resources, along with summary metrics.

**Any Two Sessions**

You can compare any two sessions, regardless of whether they were run on the same schedule or integration. Comparing sessions from different integrations is valid — for example, comparing a pre-migration scan of your AWS staging account against a post-migration scan.

---

## Comparison Summary

The top of the results page shows a high-level summary across all change categories:

| Metric | Description |
|--------|-------------|
| **Resources Added** | Count of new resources present in the newer session but not the older |
| **Resources Removed** | Count of resources in the older session that no longer exist |
| **Resources Modified** | Count of resources present in both sessions with configuration differences |
| **Resources Unchanged** | Count of resources identical in both sessions |
| **Cost Delta** | Estimated monthly cost change (positive = cost increase, negative = savings) |
| **Security Regressions** | New security findings in the newer session not present in the older |
| **Security Improvements** | Findings resolved between sessions |
| **Compliance Violations Added** | New policy violations in the newer session |
| **Compliance Violations Resolved** | Violations fixed between sessions |

---

## Change Categories

### Added Resources

Resources that exist in the newer session but were not present in the older session. These represent net-new infrastructure — intentional deployments or resources created outside your IaC workflow.

Each added resource shows:
- Resource type and name
- Cloud provider, account, and region
- Estimated monthly cost for the new resource
- Tags applied at discovery time

### Removed Resources

Resources present in the older session that no longer appear in the newer session. These may represent intentional teardowns, accidental deletions, or resources that moved accounts.

Each removed resource shows:
- Resource type and name
- Last known configuration metadata
- Estimated monthly cost impact (savings from removal)

### Modified Resources

Resources present in both sessions where at least one attribute changed between scans. This is the most important category for detecting unauthorized or unexpected changes.

Each modified resource shows:
- **Resource type and name**
- **Changed fields** — a field-level diff showing old value → new value
- **Cost difference** — change in estimated monthly cost for this resource

**Example modified resource diff:**

```
aws_security_group "web-sg" (sg-0abc123def)
  Region: us-east-1

  Changed:
    ingress_rules:
      - old: [{ from_port: 443, to_port: 443, cidr: 10.0.0.0/8 }]
      + new: [{ from_port: 443, to_port: 443, cidr: 10.0.0.0/8 },
               { from_port: 22,  to_port: 22,  cidr: 0.0.0.0/0 }]

  Cost difference: $0.00/mo
```

---

## Cost Delta Analysis

The cost delta section shows the net estimated monthly cost change across all modifications, additions, and removals.

| Change Type | Cost Impact |
|-------------|------------|
| Added resources | + (cost of new resources) |
| Removed resources | - (cost savings) |
| Modified resources | +/- (cost of configuration changes) |
| **Net delta** | Sum of all changes |

**Cost Estimates**

Cost estimates are based on resource type, size, and region-specific pricing. They represent monthly costs at the current configuration and may not reflect actual billed amounts, which vary with usage patterns.

---

## Security Regression Tracking

If security scanning was run on both sessions, the comparison surfaces security regressions — new vulnerabilities or misconfigurations introduced between scans.

| Field | Description |
|-------|-------------|
| **Regressions** | Findings present in the newer session that were not in the older |
| **Improvements** | Findings in the older session that are resolved in the newer |
| **Net change** | Regressions minus improvements |

A negative net change (more improvements than regressions) means your security posture improved. A positive number warrants investigation.

---

## Baselines

For ongoing drift monitoring, pin a session as a named baseline so you always have a fixed reference point to compare against.

### Creating a Baseline

### Open a Session
Navigate to the completed discovery session you want to freeze as a reference.

### Save as Baseline
Click the **Save as Baseline** option in the session actions menu.

### Name the Baseline
Give it a descriptive name: "Q2-2026-Audit", "Pre-Migration-Prod", or "Post-Security-Review".

### Compare Against It
In any future comparison, select the named baseline as one of the two sessions.

### When to Create Baselines

| Event | Baseline Name Pattern |
|-------|-----------------------|
| After a compliance audit | `audit-YYYY-MM` |
| Before a major migration | `pre-migration-<env>` |
| After production hardening | `post-hardening-prod` |
| Quarterly review | `q<N>-<YYYY>` |

Baselines remain available indefinitely, even as newer sessions accumulate. They do not expire.

---

## Automatic Comparison with Scheduled Scans

When you enable **auto-compare** on a scheduled discovery, ops0 automatically runs a comparison after each scan completes and compares against the most recent previous session for the same integration.

This gives you continuous drift monitoring with no manual steps:

1. Scheduled scan completes and creates a new session
2. ops0 finds the most recent prior session for the same integration
3. Comparison runs automatically in the background
4. Results are available in **Discovery → Compare**
5. If notification channels are configured, a summary is sent to Slack, email, or webhook

See [Scheduled Discovery](https://docs.ops0.com/docs/discovery/scheduling) for setup instructions.

---

## Example: Detecting a Security Change

### Setup

You run weekly discovery scans on your production AWS account every Sunday night. You receive a notification on Monday that the comparison detected a modified resource.

### Comparison Result

**Summary:**
- 0 resources added
- 0 resources removed
- 1 resource modified
- 127 resources unchanged
- Cost delta: $0.00/mo
- Security regressions: 1

**Modified Resource:**

```
aws_security_group "web-sg" (sg-0abc123)
  ingress_rules:
    - old: [{ port: 443, cidr: 10.0.0.0/8 }]
    + new: [{ port: 443, cidr: 10.0.0.0/8 },
             { port: 22,  cidr: 0.0.0.0/0 }]
```

**Security Regression:**
- SSH (port 22) open to the internet (0.0.0.0/0) — new finding in this session

### Action

1. Identify who added the SSH rule (use Audit Logs)
2. Remove the rule or restrict the CIDR to a known bastion IP
3. Run a new scan to confirm the fix
4. Compare the fix scan against the regression scan — security improvements should show 1

---

## Related

- [Drift Detection](https://docs.ops0.com/docs/discovery/drift-detection): How to interpret drift and act on unauthorized changes.

- [Scheduled Discovery](https://docs.ops0.com/docs/discovery/scheduling): Automate scans and enable continuous comparison.

- [Scanning Resources](https://docs.ops0.com/docs/discovery/scanning): Configure and run discovery scans.