Skip to main content
The Guard engine processes every security event through a linear 4-agent chain called the DARE pipeline: Detect, Analyze, Respond, Report. Each agent has a single responsibility and produces a typed output consumed by the next agent.

​
Pipeline Flow

SecurityEvent
     |
     v
[DetectAgent] ──> DetectionResult | null
     |
     v
[AnalyzeAgent] ──> ThreatVerdict
     |
     v
[RespondAgent] ──> ResponseResult
     |
     v
[ReportAgent] ──> Updated baseline + anonymized data
If the DetectAgent returns null (no rules matched, no threat intel hit), the event is considered benign and skipped. Otherwise, the full pipeline executes.

​
DetectAgent

Source: packages/panguard-guard/src/agent/detect-agent.ts
FieldValue
InputSecurityEvent
OutputDetectionResult or null

​
Responsibilities

  1. Sigma rule matching — runs the event against all loaded rules via the RuleEngine
  2. Threat intelligence lookup — checks source/destination IPs against 5 feed sources plus Threat Cloud blocklists (supports IPv4 and IPv6)
  3. Deduplication — skips identical detections within a 60-second window (max 500 entries in the dedup map)
  4. Event correlation — both legacy IP-based correlation (3+ events from same source IP in 5 minutes) and advanced pattern-based correlation via the EventCorrelator (7 attack patterns)

​
Internal State

BufferCapacityWindow
Correlation buffer1,000 events5 minutes
Deduplication map500 entries60 seconds

​
AnalyzeAgent

Source: packages/panguard-guard/src/agent/analyze-agent.ts
FieldValue
InputDetectionResult + EnvironmentBaseline
OutputThreatVerdict (conclusion: benign / suspicious / malicious)

​
Evidence Sources and Weights

The AnalyzeAgent collects evidence from multiple sources and calculates a weighted confidence score (0—100):
SourceWeightNotes
Sigma rule matches0.40Adjusted by feedback loop
Threat intelligence—Fixed confidence of 85 when matched
Baseline deviation0.30Time-of-day awareness (00:00—05:59 boost)
Falco/Suricata evidence0.20—0.25When kernel-level monitors are active
Attack chain correlation+5/eventMax +25 bonus
AI analysis0.30When AI provider is available
Weight distribution adapts to available sources:
Available SourcesRules/IntelBaselineAIeBPF
Rules only0.600.40——
Rules + AI0.400.300.30—
Rules + eBPF0.400.35—0.25
Rules + AI + eBPF0.300.200.300.20

​
Feedback Loop

The AnalyzeAgent maintains a per-rule feedback history:
  • High false-positive rate — confidence reduced by up to 30%
  • High true-positive rate — confidence increased by up to 10%

​
Contradiction Detection

If a high-severity rule fires but the baseline shows no deviation, confidence is reduced by 10 points. This prevents over-alerting on events that match a rule pattern but are normal for the specific environment.

​
RespondAgent

Source: packages/panguard-guard/src/agent/respond-agent.ts
FieldValue
InputThreatVerdict
OutputResponseResult

​
Confidence-Based Actions

ConfidenceAction
>= 90%Auto-execute, notify after
70—90%Ask for confirmation via Chat
< 70%Notify only, no action

​
Available Actions

ActionDescriptionPlatform
block_ipBlock source IP via firewallmacOS (pfctl), Linux (iptables), Windows (netsh)
kill_processTerminate malicious processAll (SIGTERM then SIGKILL after 5s)
isolate_fileQuarantine suspicious fileAll
disable_accountLock user accountAll
notifySend alert via ChatAll
log_onlyRecord without actionAll
Full details on safety rules and escalation are covered in Auto-Response.

​
ReportAgent

Source: packages/panguard-guard/src/agent/report-agent.ts
FieldValue
InputSecurityEvent + ThreatVerdict + ResponseResult + EnvironmentBaseline
OutputUpdated baseline + optional anonymized threat data

​
Responsibilities

  1. JSONL Logging — writes complete event records with log rotation (50 MB per file, 10 rotated files, 90-day retention)
  2. Baseline Updates — during learning mode, continuously updates the behavioral baseline with observed patterns
  3. Anonymization — IP addresses are /16-anonymized (last two octets zeroed) before Threat Cloud upload
  4. Summary Generation — produces daily (24h) and weekly (7d) summaries with top attack sources, action breakdown, and verdict distribution

​
Log Format

Each log entry is a JSON line containing: 
{
  "timestamp": "2025-01-15T14:23:01.000Z",
  "event": { "type": "network", "sourceIp": "203.0.113.50" },
  "verdict": { "conclusion": "malicious", "confidence": 95 },
  "response": { "action": "block_ip", "success": true },
  "baseline": { "deviation": true, "score": 0.85 }
}