> ## Documentation Index
> Fetch the complete documentation index at: https://docs.panguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Real-Time Protection

> Set up Panguard Guard for continuous monitoring, learn how the 7-day learning period works, and configure automated threat response.

# Real-Time Protection

Panguard Guard runs 24/7 on your system, monitoring processes, network connections, files, and logs. It uses a four-agent AI pipeline to detect, analyze, respond to, and report on security threats in real time.

<Info>
  For pre-install security, see [Skill Auditor](/products/overview) -- the recommended first step
  before running any AI agent skill.
</Info>

***

## Quick Start

<Steps>
  <Step title="Start Guard">
    ```bash theme={null}
    panguard guard start
    ```

    Guard enters **learning mode** for the first 7 days, observing your system's normal behavior.
  </Step>

  <Step title="Check Status">
    ```bash theme={null}
    panguard guard status
    ```

    ```
      -- Guard Status -----------------------

      Status:     Running
      Mode:       Learning (Day 3/7)
      PID:        12345
      Uptime:     3d 14h 22m
      Events:     12,847 observed
      Baseline:   42% complete
    ```
  </Step>

  <Step title="Wait for Protection Mode">
    After 7 days, Guard automatically transitions to **protection mode** and begins active threat detection and response.
  </Step>
</Steps>

***

## Learning Mode (Days 1-7)

During the learning period, Guard silently observes and records:

* **Processes** -- Which programs normally run, startup times, resource usage
* **Network** -- Normal connection patterns, common ports, traffic characteristics
* **Files** -- Change patterns in critical directories
* **Users** -- Login times, source IPs, operational patterns

<Info>
  Guard does not generate alerts during learning mode. This prevents the flood of false positives
  that makes most security tools useless. You receive a daily learning progress summary via Chat.
</Info>

***

## Protection Mode (Day 8+)

Once the baseline is established, Guard activates full protection:

* Events that deviate from the baseline trigger alerts
* The three-layer AI funnel analyzes suspicious events
* Automated or manual responses based on confidence level
* Real-time notifications via your configured Chat channel

### Confidence-Based Response

| Confidence | Action                        | Example                                             |
| ---------- | ----------------------------- | --------------------------------------------------- |
| > 90%      | Auto-execute, notify after    | Known malicious IP automatically blocked            |
| 70-90%     | Ask for confirmation via Chat | Suspicious process -- asks if you want to terminate |
| \< 70%     | Notify only                   | Minor anomaly -- informs you for observation        |

***

## The Four-Agent Pipeline

Every security event flows through four specialized agents:

```
  Event -> [Detect] -> [Analyze] -> [Respond] -> [Report]
```

| Agent            | Role                                                                                  |
| ---------------- | ------------------------------------------------------------------------------------- |
| **DetectAgent**  | Rule matching (ATR), threat intelligence lookup, event correlation                    |
| **AnalyzeAgent** | Evidence collection, weighted confidence scoring, AI reasoning via three-layer funnel |
| **RespondAgent** | Action execution (block IP, kill process, isolate file), safety checks, escalation    |
| **ReportAgent**  | Event logging, baseline updates, anonymized data for Threat Cloud                     |

***

## Response Actions

Guard can execute the following response actions automatically:

| Action                  | Description                                               | Platform Support                                 |
| ----------------------- | --------------------------------------------------------- | ------------------------------------------------ |
| **IP Block**            | Block malicious IP addresses                              | macOS (pfctl), Linux (iptables), Windows (netsh) |
| **File Isolation**      | Quarantine suspicious files with SHA-256 record           | All platforms                                    |
| **Process Termination** | Kill malicious processes (SIGTERM, then SIGKILL after 5s) | All platforms                                    |

### Safety Protections

Guard includes built-in safety rules to prevent accidental damage:

* **Whitelisted IPs:** `127.0.0.1`, `::1`, `localhost`, `0.0.0.0` (plus user-configured)
* **Protected processes:** `sshd`, `systemd`, `init`, `launchd`, `node`, `panguard-guard`
* **Protected accounts:** `root`, `Administrator`, `SYSTEM`
* **Network isolation** requires confidence >= 95%
* **Self-process kill** prevention

***

## Integrated Threat Intelligence

Guard automatically queries 5 threat intelligence feeds:

* **ThreatFox** -- IoC database (IPs, domains, URLs, file hashes)
* **URLhaus** -- Malware distribution URLs
* **Feodo Tracker** -- C2 server tracking
* **GreyNoise** -- IP reputation (targeted vs. mass scanning)
* **AbuseIPDB** -- Community-reported malicious IPs

Feeds update every hour with local caching to avoid redundant queries.

***

## Rule Engine

### ATR Rules

Guard ships with 768 bundled ATR rules. You can also add custom rules:

```yaml theme={null}
# Custom rule: Detect prompt injection in tool response
id: ATR-CUSTOM-001
name: SSH Brute Force via Agent
severity: high
detection:
  patterns:
    - event_type: login_failed
      service: ssh
  context: system_event
action: alert
```

Place `.yml` files in Guard's rules directory. Guard automatically loads new rules with hot reload support.

***

## Managing Guard

```bash theme={null}
# Start Guard
panguard guard start

# Check status
panguard guard status

# Stop Guard
panguard guard stop

# View current configuration
panguard guard config

# Install as system service (auto-start on boot)
panguard guard install
```

<Tip>
  For production environments, install Guard as a system service so it starts automatically on boot
  and restarts on failure. See the [System Service guide](/guides/system-service).
</Tip>

***

## CLI Reference

```
panguard guard <command> [options]

Commands:
  start              Start the Guard engine
  stop               Stop the Guard engine
  status             Display status
  install            Install as system service
  uninstall          Remove system service
  config             Display current configuration

Options:
  --data-dir <path>  Data directory (default: ~/.panguard-guard)
```

***

## Related

<CardGroup cols={2}>
  <Card title="Learning Mode" icon="graduation-cap" href="/concepts/learning-mode">
    Deep dive into the 7-day learning period and baseline building.
  </Card>

  <Card title="Three-Layer AI Funnel" icon="brain-circuit" href="/concepts/three-layer-ai">
    How rules, local AI, and cloud AI work together.
  </Card>

  <Card title="System Service" icon="gear" href="/guides/system-service">
    Install Guard as a systemd/launchd service.
  </Card>

  <Card title="Notification Setup" icon="bell" href="/guides/notifications-setup">
    Configure how Guard notifies you about threats.
  </Card>
</CardGroup>