What problem does it solve? Repeated security audits produce the same findings over and over, making it hard to tell what actually changed. This Skill compares the current audit against the previous run so only genuinely new problems, regressions, and cleared items surface for reporting. ## Core Features & Use Cases - Delta computation: Compares current findings against the previous run using journal timestamps to identify newly-opened findings at or above the notify severity. - Regression detection: Highlights fixed-to-regressed transitions as the highest-signal event, since a fix that came back demands immediate attention. - Profile-aware signals: Applies different delta rules for server versus workstation profiles, including new outbound network destinations and log-retention regressions on workstations. - Run summary recording: Writes a one-line summary of new, regressed, and cleared counts via the journal, which the loop threshold-checks to decide whether to email a report. - Use Case: After running a nightly hardening scan on a Debian server, use this Skill to determine that one previously-fixed SSH configuration issue has regressed and two new medium-severity findings appeared, then record the summary so the reporting step emails you. ## Quick Start Run the correlate-findings step after the observe skills in a watchman audit to compute what changed since the last run and record the run summary.
