> ## Documentation Index
> Fetch the complete documentation index at: https://docs.panguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Learning Mode

> How Panguard Guard spends 7 days learning your system's normal behavior before activating protection.

# Learning Mode

Guard spends 7 days observing your system before it starts protecting it. This is not laziness -- it is how Panguard avoids the flood of false positives that makes most security tools useless.

## Why a Learning Period?

Traditional security tools start alerting the moment they are installed. The result:

* Legitimate cron jobs flagged as suspicious processes
* Internal services treated as anomalous connections
* Hundreds of alerts per day, nearly all false positives
* Users disable notifications, defeating the purpose of the tool

Panguard Guard spends 7 days observing what **normal looks like** on your system, then determines what is **abnormal**.

***

## What Happens During Learning

<Steps>
  <Step title="Days 1-3: Collect Baseline">
    Guard silently observes and records:

    * **Process baseline** -- Which programs normally run, their startup times, and resource usage
    * **Network baseline** -- Normal connection patterns, common ports, traffic characteristics
    * **File baseline** -- Change patterns in critical directories
    * **User baseline** -- Login times, source IPs, operational patterns
  </Step>

  <Step title="Days 4-7: Build Model">
    Guard analyzes the collected data:

    * Calculates normal behavior ranges (mean + standard deviation)
    * Identifies periodic patterns (daily backups, scheduled updates)
    * Marks known safe behaviors to prevent future false positives
  </Step>

  <Step title="Day 8+: Enter Protection Mode">
    Guard automatically transitions:

    * Switches to active protection mode
    * Behaviors deviating from the baseline trigger alerts
    * Continuous learning ensures the baseline evolves with your environment
  </Step>
</Steps>

***

## Learning Mode vs. Protection Mode

| Property          | Learning Mode                   | Protection Mode                    |
| ----------------- | ------------------------------- | ---------------------------------- |
| **Activation**    | Automatic after installation    | Automatic after 7 days             |
| **Alerts**        | None generated                  | Generated when baseline deviates   |
| **Auto-response** | Not executed                    | Executed based on confidence level |
| **Notifications** | Daily learning progress summary | Real-time threat notifications     |
| **AI analysis**   | Observation only                | Full three-layer funnel            |

***

## Checking Learning Progress

```bash theme={null}
panguard guard status
```

Example output during the learning period:

```
  -- Guard Status -----------------------

  Mode:       Learning (Day 3/7)
  Uptime:     3d 14h 22m
  Events:     12,847 observed
  Baseline:   42% complete
  Processes:  187 baselined
  Networks:   34 patterns learned
```

***

## Confidence-Based Response in Protection Mode

Once Guard enters protection mode, it uses confidence levels to decide how to respond:

| Confidence | Action                        | Example                                                |
| ---------- | ----------------------------- | ------------------------------------------------------ |
| > 90%      | Auto-execute response         | Known malicious IP -- automatically blocked            |
| 70-90%     | Ask for confirmation via Chat | Suspicious process -- asks if you want to terminate it |
| \< 70%     | Notify only, no action taken  | Minor anomaly -- informs you for observation           |

<Tip>
  This tiered approach ensures high-certainty threats are handled immediately, while uncertain
  situations are escalated to your judgment.
</Tip>

***

## Mode Transition Criteria

The transition from learning to protection mode is not purely time-based. Guard also evaluates:

* **Baseline confidence** -- Must reach a threshold (>= 0.7) indicating sufficient data
* **Minimum event count** -- Enough events must be observed to form a representative baseline
* **Pattern coverage** -- Process, network, login, and port patterns must all have data

<Info>
  If your system has very low activity, the learning period may extend beyond 7 days until the
  baseline confidence threshold is met.
</Info>

***

## Continuous Baseline Updates

Protection mode does not freeze the baseline. Guard continuously adapts:

* **24-hour pruning cycle** -- Stale patterns older than 30 days are removed
* **New patterns integrated** -- Legitimate new services or processes are gradually incorporated
* **Time-of-day awareness** -- Events during 0:00-5:59 receive a confidence boost (unusual activity window)

***

## Resetting the Learning Period

If your system undergoes major changes (server migration, large-scale service deployment), you can reset the learning period:

```bash theme={null}
panguard guard stop
# Clear baseline files in the data directory
panguard guard start
```

Guard will re-enter the 7-day learning mode and build a fresh baseline.

<Warning>
  Resetting clears all learned patterns. Guard will not generate alerts or auto-respond until the
  new learning period completes.
</Warning>

***

## Related

<CardGroup cols={2}>
  <Card title="Three-Layer AI Funnel" icon="brain-circuit" href="/concepts/three-layer-ai">
    How the rule engine, local AI, and cloud AI work together.
  </Card>

  <Card title="Security Score" icon="chart-bar" href="/concepts/security-score">
    The 0-100 scoring system that summarizes your security posture.
  </Card>
</CardGroup>