<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-change-failure-correlation
description: >-
  Correlate security incidents with infrastructure and application
  changes to identify change-induced failures, measure change failure
  rate, and implement feedback loops between change management and
  incident response.
domain: cybersecurity
subdomain: incident-management
tags:
  - change-management
  - correlation
  - failure-analysis
  - dora-metrics
  - change-failure-rate
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040", "TA0003"]
  nist-csf: ["RS.AN-1", "RS.AN-3", "PR.IP-3"]
  frameworks: ["DORA Metrics", "ITIL Change Management", "NIST SP 800-128"]
---

# Performing Change Failure Correlation

## Overview

Change failure correlation identifies the relationship between
infrastructure/application changes and subsequent security incidents.
By correlating change records with incident timelines, organizations
can measure their change failure rate, identify high-risk change
patterns, and implement targeted controls to prevent change-induced
security failures.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Change management records | Deployment logs, change tickets |
| Incident timeline data | Incident records with timestamps |
| CMDB integration | System-to-service mapping |
| CI/CD pipeline logs | Deployment frequency and content |

## Key Concepts

### Correlation Model

```
CHANGE TIMELINE          INCIDENT TIMELINE
│                        │
├── Deploy v2.3.1 ───────┤
│   (14:00 UTC)          │
│                        ├── Alert: 500 errors spike
│                        │   (14:15 UTC)
│                        │
│                        ├── Incident: Auth bypass
│                        │   (14:22 UTC)
│                        │
│   CORRELATION WINDOW   │
│   ◀── 24 hours ──▶    │
│                        │
│   Change → Incident    │
│   Confidence: HIGH     │
│   Lag: 22 minutes      │
```

### Change Risk Scoring

| Factor | Weight | Description |
|--------|--------|------------|
| Change scope | 0.25 | Lines changed, services affected |
| Change type | 0.20 | Config, code, infra, permission |
| Change time | 0.15 | Business hours vs off-hours |
| Change author experience | 0.15 | Historical failure rate |
| Review coverage | 0.15 | Peer review, automated checks |
| Rollback readiness | 0.10 | Rollback plan tested |

### DORA Change Failure Rate

```
Change Failure Rate = Failed Changes / Total Changes × 100

ELITE:    < 5%
HIGH:     5–10%
MEDIUM:   10–15%
LOW:      > 15%
```

### Correlation Categories

| Category | Description | Example |
|----------|------------|---------|
| Direct causal | Change introduced the vulnerability | Deploy removed auth check |
| Configuration drift | Change created misconfiguration | Firewall rule permissive |
| Dependency failure | Change broke upstream/downstream | API contract violation |
| Timing coincidence | Change and incident unrelated | Deploy during active attack |

## Workflow

1. Collect change records from all deployment pipelines
2. Normalize change and incident timelines to common format
3. Apply correlation window to identify candidate pairs
4. Score correlation confidence using multiple signals
5. Classify correlation type (causal, drift, dependency, coincidence)
6. Calculate change failure rate metrics
7. Generate feedback for change management process

```bash
# Correlate changes with incidents
node agent.js correlate --incident-id INC-2026-0200 \
  --window-hours 24

# Calculate change failure rate
node agent.js failure-rate --period monthly

# Score change risk
node agent.js score-change --change-id CHG-2026-0500
```

## Verification

- [ ] All incidents checked for change correlation within 48 hours
- [ ] Correlation confidence scored with supporting evidence
- [ ] Change failure rate tracked as DORA metric monthly
- [ ] High-risk change patterns identified and documented
- [ ] Feedback loop established with change management team

## References

- NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide
- MITRE ATT&CK Framework — https://attack.mitre.org/
- DORA Metrics
