Skip to main content

Create a Configuration Baseline

A configuration profile is a baseline of workspace settings that every assigned workspace is measured against. This guide creates one from a reference workspace and puts it to work. For how drift detection works, see Configuration drift.

Prerequisites​

  • Admin or Owner role
  • Enrolled workspaces, including one whose settings you consider correct

Step 1: Create the Profile​

  1. Go to Policies → Config
  2. Click New profile
  3. The dialog offers two starting points: Start from scratch (a blank profile, add settings manually) or one card per workspace, labeled "Import current settings as your baseline"
  4. Pick your reference workspace

Kostavo captures that workspace's current settings as the baseline.

Key point: import is a snapshot, not a link. The profile does not follow the reference workspace afterwards; if you change your standard, edit the profile.

Step 2: Review the Baseline​

The editor lists every captured setting with its expected value and a severity. Before enforcing anything:

  • Remove settings you do not care about; every remaining row will generate findings on workspaces that differ
  • Adjust expected values where the reference workspace was not actually right
  • Set severities to match how much each setting matters (a disabled IP access list is not the same as a cosmetic toggle)

Step 3: Assign Workspaces​

Still in the editor, the Workspaces card assigns the profile. Add every workspace that should conform to the baseline, then save.

Step 4: Read the Drift​

On the next scan, each assigned workspace is compared against the baseline. Deviations appear as findings of type Config, and two views show the state of the estate:

Monitoring → Configs for per-setting compliance with expected vs actual values:

The settings compliance view comparing workspace settings against the baseline

Policies → Config Matrix for the estate-wide grid, settings as rows and workspaces as columns:

The config matrix with settings as rows and workspaces as columns

Expect a wave of findings on the first scan. That wave is the work queue for bringing the estate in line; it is why you created the baseline.

Changing the Baseline Later​

Edit the profile whenever your standard changes. The next scan re-evaluates every assigned workspace against the new values; use the config matrix first to see the blast radius before committing a change.