> ## Documentation Index
> Fetch the complete documentation index at: https://docs.panguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# panguard guard

> Manage the real-time endpoint protection agent.

The `guard` command controls Panguard's real-time protection agent -- a three-layer AI pipeline that monitors your system continuously, detects threats, and responds automatically. Guard runs as a background service and reports events through your configured notification channels.

## Usage

```bash theme={null}
panguard guard <subcommand> [options]
```

## Subcommands

| Subcommand  | Description                                           |
| ----------- | ----------------------------------------------------- |
| `start`     | Start the Guard agent                                 |
| `stop`      | Stop the running Guard agent                          |
| `status`    | Show current Guard status and statistics              |
| `install`   | Install Guard as a system service (systemd / launchd) |
| `uninstall` | Remove the Guard system service                       |
| `config`    | View or modify Guard configuration                    |
| `help`      | Show Guard subcommand help                            |

## Options

<ParamField path="--data-dir" type="string">
  Override the default data directory where Guard stores logs, baselines, and state files. Defaults
  to `~/.panguard/guard/`.
</ParamField>

## Examples

<CodeGroup>
  ```bash Start Guard protection theme={null}
  panguard guard start
  ```

  ```bash Check Guard status theme={null}
  panguard guard status
  ```

  ```bash Install as system service theme={null}
  panguard guard install
  ```

  ```bash Use custom data directory theme={null}
  panguard guard start --data-dir /opt/panguard/data
  ```

  ```bash Stop Guard theme={null}
  panguard guard stop
  ```

  ```bash View Guard configuration theme={null}
  panguard guard config
  ```
</CodeGroup>

## How It Works

Guard operates through three layers of AI processing:

1. **Layer 1 -- Rule Engine** -- ATR rules for known threat patterns
2. **Layer 2 -- Behavioral AI** -- Machine learning baselines detect anomalous process, network, and file activity
3. **Layer 3 -- LLM Judgment** -- Large language model correlates events, judges severity, and generates plain-language alerts

<Tip>
  After starting Guard, it enters a **learning mode** for the first 24 hours to establish behavioral
  baselines. During this period, you may see more informational alerts than usual.
</Tip>

## Related

<CardGroup cols={2}>
  <Card title="Guard Product Overview" icon="shield-check" href="/products/guard/overview">
    Architecture and design of the Guard agent.
  </Card>

  <Card title="Agent Pipeline" icon="diagram-project" href="/products/guard/agent-pipeline">
    Deep dive into the three-layer AI processing pipeline.
  </Card>

  <Card title="Guard Configuration" icon="gear" href="/configuration/guard-config">
    Customize monitors, thresholds, and auto-response rules.
  </Card>
</CardGroup>