Skip to main content
The guard command controls Panguard’s real-time protection agent — a three-layer AI pipeline that monitors your system continuously, detects threats, and responds automatically. Guard runs as a background service and reports events through your configured notification channels.

​
Usage

​
Subcommands

​
Options

​
--data-dir
string
Override the default data directory where Guard stores logs, baselines, and state files. Defaults to ~/.panguard/guard/.

​
Examples

​
How It Works

Guard operates through three layers of AI processing:
  1. Layer 1 — Rule Engine — ATR rules for known threat patterns
  2. Layer 2 — Behavioral AI — Machine learning baselines detect anomalous process, network, and file activity
  3. Layer 3 — LLM Judgment — Large language model correlates events, judges severity, and generates plain-language alerts
After starting Guard, it enters a learning mode for the first 24 hours to establish behavioral baselines. During this period, you may see more informational alerts than usual.

Guard Product Overview

Architecture and design of the Guard agent.

Agent Pipeline

Deep dive into the three-layer AI processing pipeline.

Guard Configuration

Customize monitors, thresholds, and auto-response rules.