Skip to main content
The threat command runs a local instance of the Panguard Threat Cloud — a threat intelligence server that aggregates indicators of compromise (IoCs), campaign data, and attacker profiles from your Guard agents and Trap honeypots. It provides a REST API and real-time dashboard for threat analysis.

​
Usage

​
Subcommands

​
Options

​
--port
number
default:"9500"
Port for the Threat Cloud API and dashboard.
​
--host
string
default:"127.0.0.1"
Host address to bind the server to. Use 0.0.0.0 to listen on all interfaces.
​
--db
string
Path to the SQLite database for storing threat intelligence data. Defaults to ~/.panguard/threat/threat.db.

​
Examples

​
Intelligence Sources

The Threat Cloud aggregates data from:
When binding to 0.0.0.0, the Threat Cloud API is exposed to the network. Ensure you configure authentication and place the server behind a firewall or reverse proxy.

Threat Cloud Overview

Architecture and design of the Threat Cloud system.

Threat Cloud Deployment

Production deployment guide for Threat Cloud.

Privacy

Data handling and privacy policies for threat data.

panguard trap

Honeypots feed intelligence into Threat Cloud.