I actually use an advanced alert to run an NCM command to backup the running config anytime a node reports coming back up/online, after being down.
If you already use the alert to monitor the device, you can just add that action to the reset action of the alert.
This way I get a fresh config of the device after it comes back up/online, so I can compare it to make sure nothing changed.