Overview 4 min read View Markdown

Guardian concepts#

Guardian uses the same words as your CMDB. This page explains them, so the rest of the documentation reads clearly.

What Guardian monitors#

CI: Anything Guardian can scan: a server, a desktop or laptop, a network boundary device, or a single cloud entity such as an S3 bucket. If it has an IP address or is one cloud resource, it can be a CI.
Element: One part of a CI's configuration that Guardian records, such as a file, a registry key or a package. Most screens work at the CI and property levels, so you'll rarely see the word.
Property: One value on an element, such as DisableAntiSpyware: 1. Drift is reported property by property.
CMDB CI: A record in your ServiceNow CMDB. Guardian says CMDB CI so it's never confused with a Guardian CI. A Guardian CI can be linked to the CMDB CI it represents.

Environment: The outer container, such as Development, Staging or Production. Every CI belongs to one environment. A scan schedule can be set per environment.
CI group: A set of CIs that belong together, such as "Ubuntu web servers" or "Finance laptops". A group is static (you choose its members) or dynamic (any CI that matches its query joins automatically). Scan schedules, policies and benchmarks are assigned to groups.

Scan: One look at a CI's configuration. Guardian compares each scan with the one before it.
Drift: A property that changed between two scans. Every drift item starts unreconciled: it still needs a person, or a change request, to say it was expected.
Baseline: One scan of a CI that you pin as its known-good state, so you can see drift away from it.
Policy: A set of checks your CIs are assessed against, each scan. A check passes or fails. See Policies.
Benchmark: An industry-standard set of checks, such as a CIS Benchmark, assessed on its own schedule. See Benchmarks.

Approved with a reason (Standard): Someone confirmed the change was expected, and picked a reason such as routine patching.
Reconciled to a change request: The change is matched to an approved change request, either by a person entering its reference or automatically by change reconciliation.