Skip to main content
The guard command controls Panguard’s real-time protection agent — a three-layer AI pipeline that monitors your system continuously, detects threats, and responds automatically. Guard runs as a background service and reports events through your configured notification channels.

Usage

panguard guard <subcommand> [options]

Subcommands

SubcommandDescription
startStart the Guard agent
stopStop the running Guard agent
statusShow current Guard status and statistics
installInstall Guard as a system service (systemd / launchd)
uninstallRemove the Guard system service
configView or modify Guard configuration
helpShow Guard subcommand help

Options

--data-dir
string
Override the default data directory where Guard stores logs, baselines, and state files. Defaults to ~/.panguard/guard/.

Examples

panguard guard start

How It Works

Guard operates through three layers of AI processing:
  1. Layer 1 — Rule Engine — ATR rules for known threat patterns
  2. Layer 2 — Behavioral AI — Machine learning baselines detect anomalous process, network, and file activity
  3. Layer 3 — LLM Judgment — Large language model correlates events, judges severity, and generates plain-language alerts
After starting Guard, it enters a learning mode for the first 24 hours to establish behavioral baselines. During this period, you may see more informational alerts than usual.

Guard Product Overview

Architecture and design of the Guard agent.

Agent Pipeline

Deep dive into the three-layer AI processing pipeline.

Guard Configuration

Customize monitors, thresholds, and auto-response rules.