---
title: "Guardian concepts"
description: "The words Guardian Essentials uses, and what they mean."
product: "Guardian"
edition: "Essentials"
type: "overview"
url: "https://docs.cloudhouse.com/guardian/essentials/get-started/concepts/"
---
# Guardian concepts

Guardian uses the same words as your CMDB. This page explains them, so the rest of the documentation reads clearly.

## What Guardian monitors

CI
:   Anything Guardian can scan: a server, a desktop or laptop, a network boundary device, or a single cloud entity such as an S3 bucket. If it has an IP address or is one cloud resource, it can be a CI.

Element
:   One part of a CI's configuration that Guardian records, such as a file, a registry key or a package. Most screens work at the CI and property levels, so you'll rarely see the word.

Property
:   One value on an element, such as `DisableAntiSpyware: 1`. Drift is reported property by property.

CMDB CI
:   A record in your ServiceNow CMDB. Guardian says *CMDB CI* so it's never confused with a Guardian CI. A Guardian CI can be linked to the CMDB CI it represents.

## How CIs are organised

Environment
:   The outer container, such as Development, Staging or Production. Every CI belongs to one environment. A scan schedule can be set per environment.

CI group
:   A set of CIs that belong together, such as "Ubuntu web servers" or "Finance laptops". A group is *static* (you choose its members) or *dynamic* (any CI that matches its query joins automatically). Scan schedules, policies and benchmarks are assigned to groups.

See [Groups and environments](https://docs.cloudhouse.com/guardian/essentials/cis/groups-and-environments/index.md).

## What Guardian finds

Scan
:   One look at a CI's configuration. Guardian compares each scan with the one before it.

Drift
:   A property that changed between two scans. Every drift item starts *unreconciled*: it still needs a person, or a change request, to say it was expected.

Baseline
:   One scan of a CI that you pin as its known-good state, so you can see drift away from it.

Policy
:   A set of checks your CIs are assessed against, each scan. A check passes or fails. See [Policies](https://docs.cloudhouse.com/guardian/essentials/compliance/policies/index.md).

Benchmark
:   An industry-standard set of checks, such as a CIS Benchmark, assessed on its own schedule. See [Benchmarks](https://docs.cloudhouse.com/guardian/essentials/compliance/benchmarks/index.md).

## How drift is reconciled

Approved with a reason (Standard)
:   Someone confirmed the change was expected, and picked a reason such as routine patching.

Reconciled to a change request
:   The change is matched to an approved change request, either by a person entering its reference or automatically by [change reconciliation](https://docs.cloudhouse.com/guardian/essentials/change-reconciliation/index.md).