1.2 How Change Guardian Works

There are innumerable activities that take place on an asset, and their corresponding events are logged in by the operating system. However, all events do not require attention or pose a threat to the organization. A policy defines filters, based on which Change Guardian collects events. A policy definition contains information about the type of events to collect, risk value of an event, the users who are allowed to make the change, event severity, and so on. Change Guardian collects the events details such as who, what, when, and where. You can configure emails or alerts to receive notifications about the desired events.

You can forward Change Guardian events to other softwares for further analysis, and for long term retention. You can forward events to another Change Guardian server, Sentinel server, or Splunk Enterprise Security.

Adam Mandari is the administrator and he would like to monitor who changes critical Human Resource files in his enterprise. To allow Change Guardian to monitor this event, Adam creates a Change Guardian policy for Windows with the following definition:

Monitors changes to contents in files in c:\payroll whose patterns match * 
include only file content difference events

When an attempt is made to modify any files in the C:\payroll directory, Change Guardian Agent for Windows collects the File integrity was changed event from the Windows machine and sends it to the Change Guardian server. The event contains the name of the event, the Windows machine details, the user who triggered the event, the time at which the write action was performed, and the old and the changed content. Adam configures an alert that notifies him whenever File integrity was changed event is generated. He uses the following interfaces to view the event and take necessary action: