Track configuration changes

[ Applies to ] StorageGuard 10.1 and later  /  All supported storage, backup, SAN and cloud systems  /  Windows and Linux deployments

Findings tell you where a system is wrong today. Change Control tells you what changed, when, and whether anyone meant it to. Every scan is compared with the one before it, and each difference becomes a change event with a risk score. Use it to catch unauthorized changes, to explain why a finding appeared, and to show auditors that configurations are controlled between assessments.

Review the change timeline

1. Go to Change control > Change timeline.
2. Set a date range with From Date and To Date. The timeline stays empty until you do.
3. Narrow the view with the other filters: Search, System type, CI groups, Sites, Risk score and Status.
4. Expand a system to see its changes, and expand a change to see the difference: the configuration before and after, side by side, with the changed lines highlighted.

Each change event shows a one-line description, for example an NTP server address that changed or an HTTP service that was disabled, its risk score, and its review status.

Mark a change as authorized or unauthorized

New changes are Pending review. Click the status next to the change and select Authorized or Unauthorized.

• Authorized: the change was expected, for example it matches a change ticket.
• Unauthorized: nobody planned it. Investigate it, and revert it if needed.

Changes marked Irrelevant by StorageGuard, such as runtime statistics or process lists, aren't configuration changes and need no review.

Use the risk score

When the AI Assistant is configured, StorageGuard scores every change Low, Medium or High for the risk it introduces: a disabled audit log scores high, a changed description scores low. If you disagree with a score, click it and select another value.

Compare a system with a past point in time

To see everything that changed on one system since a known-good date, for example since the last audit:

1. Go to Change control > Side-by-side.
2. Right-click the system and select Compare.
3. In From and To, select the two scans to compare.
4. Review the differences. Switch between Normalized and Original output, and between Split and Unified layouts, to suit what you're reading.

Watch change activity over time

Change control > Overview summarizes change activity across your environment:

Widget	What it tells you
Stability score	How stable the environment is, from the volume and frequency of changes. A higher score means fewer changes per system.
Change rate	The average number of changes per day.
Recent changes	The latest changes, for quick access.
Top changing systems	The systems with the most changes in the period. A system that changes constantly is either under active work or being changed without control.
Event status	How many changes are authorized versus unauthorized.
Changes by risk score	Changes grouped by Low, Medium and High.
Changes over time, by site, by technology	Where and when changes happen.

Click Settings on the overview to adjust how far back it looks (Number of days backward), how many changes per system per week count as healthy for the Stability score, and how many Recent changes to list.

Related articles

• Compare systems against a golden image
• Get evidence for an audit
• Schedule recurring scans