Real-Time Protection

Panguard Guard runs 24/7 on your system, monitoring processes, network connections, files, and logs. It uses a four-agent AI pipeline to detect, analyze, respond to, and report on security threats in real time.

For pre-install security, see Skill Auditor — the recommended first step before running any AI agent skill.

Quick Start

Start Guard

panguard guard start

Guard enters learning mode for the first 7 days, observing your system’s normal behavior.

Check Status

panguard guard status

  -- Guard Status -----------------------

  Status:     Running
  Mode:       Learning (Day 3/7)
  PID:        12345
  Uptime:     3d 14h 22m
  Events:     12,847 observed
  Baseline:   42% complete

Wait for Protection Mode

After 7 days, Guard automatically transitions to protection mode and begins active threat detection and response.

Learning Mode (Days 1-7)

During the learning period, Guard silently observes and records:

Processes — Which programs normally run, startup times, resource usage
Network — Normal connection patterns, common ports, traffic characteristics
Files — Change patterns in critical directories
Users — Login times, source IPs, operational patterns

Guard does not generate alerts during learning mode. This prevents the flood of false positives that makes most security tools useless. You receive a daily learning progress summary via Chat.

Protection Mode (Day 8+)

Once the baseline is established, Guard activates full protection:

Events that deviate from the baseline trigger alerts
The three-layer AI funnel analyzes suspicious events
Automated or manual responses based on confidence level
Real-time notifications via your configured Chat channel

Confidence-Based Response

Confidence	Action	Example
> 90%	Auto-execute, notify after	Known malicious IP automatically blocked
70-90%	Ask for confirmation via Chat	Suspicious process — asks if you want to terminate
< 70%	Notify only	Minor anomaly — informs you for observation

The Four-Agent Pipeline

Every security event flows through four specialized agents:

  Event -> [Detect] -> [Analyze] -> [Respond] -> [Report]

Agent	Role
DetectAgent	Rule matching (ATR), threat intelligence lookup, event correlation
AnalyzeAgent	Evidence collection, weighted confidence scoring, AI reasoning via three-layer funnel
RespondAgent	Action execution (block IP, kill process, isolate file), safety checks, escalation
ReportAgent	Event logging, baseline updates, anonymized data for Threat Cloud

Response Actions

Guard can execute the following response actions automatically:

Action	Description	Platform Support
IP Block	Block malicious IP addresses	macOS (pfctl), Linux (iptables), Windows (netsh)
File Isolation	Quarantine suspicious files with SHA-256 record	All platforms
Process Termination	Kill malicious processes (SIGTERM, then SIGKILL after 5s)	All platforms

Safety Protections

Guard includes built-in safety rules to prevent accidental damage:

Whitelisted IPs: 127.0.0.1, ::1, localhost, 0.0.0.0 (plus user-configured)
Protected processes: sshd, systemd, init, launchd, node, panguard-guard
Protected accounts: root, Administrator, SYSTEM
Network isolation requires confidence >= 95%
Self-process kill prevention

Integrated Threat Intelligence

Guard automatically queries 5 threat intelligence feeds:

ThreatFox — IoC database (IPs, domains, URLs, file hashes)
URLhaus — Malware distribution URLs
Feodo Tracker — C2 server tracking
GreyNoise — IP reputation (targeted vs. mass scanning)
AbuseIPDB — Community-reported malicious IPs

Feeds update every hour with local caching to avoid redundant queries.

Rule Engine

ATR Rules

Guard ships with 768 bundled ATR rules. You can also add custom rules:

# Custom rule: Detect prompt injection in tool response
id: ATR-CUSTOM-001
name: SSH Brute Force via Agent
severity: high
detection:
  patterns:
    - event_type: login_failed
      service: ssh
  context: system_event
action: alert

Place .yml files in Guard’s rules directory. Guard automatically loads new rules with hot reload support.

Managing Guard

# Start Guard
panguard guard start

# Check status
panguard guard status

# Stop Guard
panguard guard stop

# View current configuration
panguard guard config

# Install as system service (auto-start on boot)
panguard guard install

For production environments, install Guard as a system service so it starts automatically on boot and restarts on failure. See the System Service guide.

CLI Reference

panguard guard <command> [options]

Commands:
  start              Start the Guard engine
  stop               Stop the Guard engine
  status             Display status
  install            Install as system service
  uninstall          Remove system service
  config             Display current configuration

Options:
  --data-dir <path>  Data directory (default: ~/.panguard-guard)

Learning Mode

Deep dive into the 7-day learning period and baseline building.

Three-Layer AI Funnel

How rules, local AI, and cloud AI work together.

System Service

Install Guard as a systemd/launchd service.

Notification Setup

Configure how Guard notifies you about threats.

Getting Started

Concepts

Guides

Configuration

Troubleshooting

Real-Time Protection

Real-Time Protection

Quick Start

Learning Mode (Days 1-7)

Protection Mode (Day 8+)

Confidence-Based Response

The Four-Agent Pipeline

Response Actions

Safety Protections

Integrated Threat Intelligence

Rule Engine

ATR Rules

Managing Guard

CLI Reference

Learning Mode

Three-Layer AI Funnel

System Service

Notification Setup

​Real-Time Protection

​Quick Start

​Learning Mode (Days 1-7)

​Protection Mode (Day 8+)

​Confidence-Based Response

​The Four-Agent Pipeline

​Response Actions

​Safety Protections

​Integrated Threat Intelligence

​Rule Engine

​ATR Rules

​Managing Guard

​CLI Reference

​Related

Learning Mode

Three-Layer AI Funnel

System Service

Notification Setup

Real-Time Protection

Quick Start

Learning Mode (Days 1-7)

Protection Mode (Day 8+)

Confidence-Based Response

The Four-Agent Pipeline

Response Actions

Safety Protections

Integrated Threat Intelligence

Rule Engine

ATR Rules

Managing Guard

CLI Reference

Related