“Who installed that?” - building a fleet change feed where the hard part was the silence

Every incident bridge I’ve ever sat on starts the same way. Changes go in Thursday night. Friday morning, something’s broken. And before anyone pulls a single log, somebody asks the only question that matters: “what changed?”

In my previous job I helped run a hospital fleet of about 30,000 Windows endpoints, and I can tell you how that question actually gets answered at scale: badly. You open the device in your management console and eyeball installed software against your memory of it. You ask in the team channel if anyone touched it. You check the change calendar, which records what was approved, which is a different thing from what happened. The whole culture of change freezes exists because nobody can cheaply see change - so instead we ritually forbid it and hope.

The absurd part is that the data was always there. Any fleet tool worth its agent collects inventory on a schedule. Mine has today’s snapshot and yesterday’s. The delta between them is the answer to “what changed?” - it was just never anyone’s product.

So I made it RFF’s: a single chronological Changes feed for the whole fleet. Every device’s inventory gets diffed against its previous snapshot at ingest, and the differences become typed events you can filter by class, device, group, and time: software installed, removed, or version-changed; a security product appearing or - more interesting - disappearing; an OS build moving; and from the agent’s newer collectors, new autoruns, new scheduled tasks, and local-admin membership changes. Each device page grew a strip of its own recent changes that links into the fleet view. There’s an opt-in daily digest email that defaults to just the security-relevant classes, because “47 Chrome updates” is not a briefing.

Here’s the part worth a blog post, though. The diff engine took an afternoon. Almost everything else was learning what to shut up about.

Noise is the product

A change feed has exactly one failure mode that kills it: the day an operator sees the third false “change,” they stop reading, and now you’ve shipped a page nobody opens. Every hour of engineering after the diff went into silence:

RunOnce is suppressed by default. Windows uses RunOnce as a scratchpad - components write keys, execute them, delete them, all day. Faithfully reporting that is technically true and practically spam. It’s off by default with an opt-in, and yes, that’s a real trade: attackers use RunOnce too. We chose a feed people read over a feed that’s complete and muted.
Per-user registry hives load and unload with sessions. The first version reported per-user software “removed” at logoff and “installed” at logon, forever, for every user. The classifier now recognizes hive flap for what it is - the same fact appearing and disappearing from visibility, not from the box.
RFF suppresses its own agent updates. A change tool that announces itself every self-update is spam with extra steps.
A missing inventory section is not a fleet catastrophe. When an agent version starts (or stops) collecting a section, the naive diff reads that as everything in it being added or removed - times every device. An absent-section guard treats “didn’t check” as its own state, distinct from “not there.” Tri-state honesty: changed, didn’t, didn’t check.
Bulk changes get a threshold. An imaging job or a big deploy shouldn’t detonate the feed into 400 identical rows.
We deliberately don’t track scheduled tasks flipping enabled/disabled. Windows toggles its own tasks constantly. Creation is signal; churn is weather.

None of this is clever. All of it is the difference between a feature and a demo.

Facts, not verdicts

The other hard rule got written down before the first line of collector code: report, never score.

When the feed says a box’s local Administrators group went from 2 members to 3, that is exactly EDR-shaped telemetry, and the temptation to stamp “⚠️ possible privilege escalation” on it is enormous - it demos great. We refuse, every time, for three reasons. It would be a lie about what RFF is (we’re not EDR, by design). It would be worse at detection than the products that do nothing else. And verdict layers rot: after the tenth wrong “suspicious,” operators trust nothing on the page, including the facts.

“A new local admin was added on DESKTOP-4F2” is a sentence we can defend on every box, every time. Whether it’s your PAM rollout or a problem is your call - you have the context, we have the diff. The same restraint shaped our shadow-AI work: identity and metadata, never content, never a judgment dressed up as data.

Why it’s free

The feed and the digest cost you nothing on any plan, including the free one, and that’s not a promo. RFF’s pricing line is simple: you pay for scale, not features. Every operational feature - the feed, the checks, the alerts, remediation, the remote tools - is free up to your endpoint cap; the bill only starts when your fleet outgrows it. Splitting a feature everyone needs into paid tiers would mean deliberately keeping some customers blind or hands-tied, which is a strange thing to charge for.

There’s a version of this post that ends with a grand claim about anomaly detection roadmaps. Skip it. The honest pitch is smaller and, I think, better: the first question of every incident now has a page. It loads in a second, it covers every box, and when it’s quiet, it’s because nothing changed - not because nobody looked.

It’s live now - changelog here, or start free on 100 endpoints and watch your own fleet’s Friday morning scroll past.