What should happen after a snapshot comparison?
When the workspace reports an added, removed or changed record, first establish whether the inputs are comparable. Then identify the intended configuration, responsible owner and next action. A difference is an investigation lead, not a security verdict.
A practical review should answer these questions before a record is removed or changed:
| Question | Evidence worth retaining |
|---|---|
| Are scopes and views comparable? | Base domain, DNS view, collection tool and options |
| When was each export collected? | Timestamps and intended comparison window |
| Was the change approved? | Change request, provider history or service owner confirmation |
| Does it affect a dependency? | Application, email, vendor, redirect or integration ownership |
| What is the final decision? | Reviewer, evidence, action, owner and review date |
Classify the observation
- Expected: Matched to an approved change with supporting records.
- Needs confirmation: Difference is real in the provided data but its purpose or owner is unresolved.
- Stale or incomplete source: The comparison may reflect missing collection coverage rather than asset changes.
- Cleanup candidate: An authorized owner agrees the record is no longer needed; normal change control still applies.
Avoid a simplistic high/medium/low score based only on an added hostname or changed CNAME. Neither event alone establishes severity, exposure or exploitability.
Worked review record
Suppose a comparison finds portal.example.com A 192.0.2.40 only in the current zone. An analyst could record:
| Field | Sample entry |
|---|---|
| Observation | Added A record in current export |
| Source | Baseline and current zone filenames; timestamps recorded separately |
| Verification method | Check provider configuration and authorized change record |
| Owner | Application owner to be confirmed |
| Decision | Needs confirmation; no remediation yet |
Only after confirming the intended state should the owner decide whether to retain, modify or remove the record. The fictional snapshot walkthrough uses this exact example.
Preserve a report that someone else can reproduce
Keep the original files, generated changes CSV or snapshot JSON, any import warnings, and the review worksheet together. Recon.ph retains source filenames in normalized output but does not preserve full collection metadata such as account IDs, collection timestamps or signed change approvals. Capture those separately.
The free change-review worksheet provides columns for hostname, observation, source time, verification method, owner, decision and notes. Use supported formats and matching rules to understand exactly what the workspace did and did not compare.