Skip to main content
The guard command controls Panguard’s real-time protection agent — a three-layer AI pipeline that monitors your system continuously, detects threats, and responds automatically. Guard runs as a background service and reports events through your configured notification channels.

Usage

panguard guard <subcommand> [options]

Subcommands

SubcommandDescriptionPlan Required
startStart the Guard agentSolo+
stopStop the running Guard agentSolo+
statusShow current Guard status and statisticsCommunity (Free)
installInstall Guard as a system service (systemd / launchd)Solo+
uninstallRemove the Guard system serviceSolo+
configView or modify Guard configurationSolo+
helpShow Guard subcommand helpAll

Options

--data-dir
string
Override the default data directory where Guard stores logs, baselines, and state files. Defaults to ~/.panguard/guard/.

Examples

panguard guard start

How It Works

Guard operates through three layers of AI processing:
  1. Layer 1 — Rule Engine — Sigma rules and YARA signatures for known threat patterns (available on Community plan as status-only)
  2. Layer 2 — Behavioral AI — Machine learning baselines detect anomalous process, network, and file activity
  3. Layer 3 — LLM Judgment — Large language model correlates events, judges severity, and generates plain-language alerts
After starting Guard, it enters a learning mode for the first 24 hours to establish behavioral baselines. During this period, you may see more informational alerts than usual.

Plan Requirements

guard status is available on the Community (Free) plan. Starting, stopping, installing, and configuring Guard requires Solo ($9/mo) or higher.