If the Change Guardian server is configured to send its events to Sentinel, you can view Change Guardian events in Sentinel. To verify whether Change Guardian is configured, contact your system administrator.
To view the Change Guardian events and the event details, run a search by using the appropriate query, for example, pn:Change Guardian, then click Search. For more information about searching events in Sentinel, see Searching Events.
Change Guardian events indicates activities such as:
Changes or access to critical files, platforms and systems
Activities of privileged users
Each event provides detailed information about the file that was changed, the actual changes made to the file, and so on. For more information about the event details, see Understanding Event Information in the Change Guardian User Guide.
To view the event details, click the Change Guardian icon associated with the event.