In order to manage a Cisco IOS or SSH device, Cisco Defense Orchestrator (CDO) must have its own stored copy of the device's configuration file. The first time CDO reads and saves a copy of the device's configuration file is when the device is onboarded. Subsequently, when CDO checks the configuration from the device, it takes a copy of the device's configuration file and and completely overwrites the copy of the configuration file it maintains in its own database. See Reading, Discarding, Checking for, and Deploying Configuration Changes, for more information about how CDO manages the copy of the device configuration stored on CDO and the one stored on the device.
See Check for Changes to learn how to detect changes made directly to the Cisco IOS or SSH device outside of CDO.
See Discard Changes to learn how to "undo" configuration changes you have started to make on CDO but have not deployed to the IOS or SSH device.