I recently had this discussion with a customer and we walked through the steps together trying to get to the bottom of this.

So you get an Alert within Lacework….so what. Why did that happen because I know I didn’t just open up my resources to 0.0.0.0/0 inbound...or did I (I am sure it was the dog).

• An Alert Comes in relating to some configuration issue
• Review the Alert (Note: You can proactively look up these bad boys by going to the alert page, then filtering by “alert subcategory = compliance.”)
• Click on the Alert
• Scroll down within the Details page to the “What” section
• Click on the “Resources” tab 
• Click on the Resource value (Note: It should be highlighted blue as a hyperlink)
  • Once you are in the Resource inventory page, if one exists, there will be a “configuration history” table
• Click the checkbox on the “configuration” Column for two of the historical configuration items.
• Click the now highlighted button that says “Diff configurations”

In the end, you should have something that looks kinda like this.  This is a side-by-side comparison of the lines that changed from your Historical Configuration data to the Latest configuration data.