Fleet / cohort analysis

When you run a population of similar devices you often have no single golden reference — but the fleet is the reference. --fleet <dir> learns “normal” from the population and flags the device that differs from its peers.

# on each device, capture its state:
delta --processes --ports --packages --netif --baseline /tmp/$(hostname).json
# collect those files into one directory, then analyze:
delta --fleet ./fleet-snapshots
delta --fleet ./fleet-snapshots --json

Each regular file is one device — the ordinary baseline JSON (see Baseline capture), so there is no new format. Exit code 1 when an outlier is found, else 0. At least 3 devices are required to define a majority.

How it works

Every observable is reduced to a feature key:

Domain	Key
Process	proc:<name>
Port	port:<port-or-range>/<proto>/<state>
Package	pkg:<name>@<version>
File	file:<path>@<checksum>
Filesystem	fs:<fstype>@<root>
Interface	netif:<name> (+ =promisc, /mac=<mac>)
Route	route:<dest>/<mask>-><gateway>
Neighbor	neigh:<ip>@<mac>

Delta counts each feature’s prevalence and, per device, reports two outliers:

• RARE — a feature very few devices have (a stray service, an unexpected package, a file whose checksum differs — a per-device implant or tampering);

• MISSING — a near-universal feature this device lacks (a removed/disabled protection).

Mid-prevalence features are legitimate fleet variation and are not reported. With N devices and rare_max = max(1, floor(0.1·N)), a feature is rare if at most rare_max devices have it and common if at most rare_max lack it.

Notes

• Point-in-time; cohort must be homogeneous (group like devices).

• A compromised majority hides itself — cohort analysis finds the odd one out, not fleet-wide compromise; pair it with Packages & vulnerabilities and a golden Baseline capture.