Monitor Types

The Guard agent supports 10 monitor types organized into two tiers. Built-in monitors are available on all platforms with zero dependencies. Advanced monitors require specific OS versions or external tools but provide deeper visibility. All monitors emit normalized SecurityEvent objects that feed into the DARE pipeline.

Built-in Monitors

These 4 monitors ship with @panguard-ai/core and work on macOS, Linux, and Windows out of the box.

Log Monitor

Field	Details
Source	`core/monitors`
Platforms	Linux, macOS, Windows
Data sources	syslog (`/var/log/syslog`, `/var/log/auth.log`), Windows Event Log, application log files
Capabilities	Reads and normalizes log entries to `SecurityEvent` format. Supports tailing for real-time monitoring.

Network Monitor

Field	Details
Source	`core/monitors`
Platforms	Linux, macOS, Windows
Data sources	`/proc/net/tcp` (Linux), `netstat` (cross-platform)
Capabilities	Monitors active network connections. Detects new connections, unusual ports, traffic to known-bad IPs, and anomalous connection patterns.

Process Monitor

Field	Details
Source	`core/monitors`
Platforms	Linux, macOS, Windows
Data sources	`/proc` filesystem (Linux), OS APIs (macOS/Windows)
Capabilities	Scans running processes. Detects new/unusual process spawning, suspicious command lines, and privilege changes.

File Monitor

Field	Details
Source	`core/monitors`
Platforms	Linux, macOS, Windows
Data sources	inotify (Linux), FSEvents (macOS), ReadDirectoryChangesW (Windows)
Capabilities	Watches critical filesystem paths for modifications. Tracks file creation, modification, deletion, and permission changes.

Advanced Monitors

These 4 monitors ship with @panguard-ai/panguard-guard and provide kernel-level or specialized visibility. All gracefully degrade when their dependencies are not installed.

Syscall Monitor (eBPF)

Field	Details
Source	`syscall-monitor.ts`
Dependency	Linux Kernel 4.18+
Data source	`/proc` polling for process and network activity
Capabilities	Detects suspicious processes, privilege escalation attempts, and C2 (command-and-control) connections at the syscall level.
Event types	Process creation, privilege changes, network syscalls

Memory Scanner

Field	Details
Source	`memory-scanner.ts`
Dependency	`CAP_SYS_PTRACE` capability
Capabilities	Scans process memory regions for fileless malware signatures, injected code, and suspicious memory patterns. Detects threats that never touch the filesystem.
Event types	Memory injection, fileless malware, process hollowing

DPI Monitor (Deep Packet Inspection)

Field	Details
Source	`dpi-monitor.ts`
Dependency	None (userspace implementation)
Capabilities	Protocol-level traffic analysis. Detects C2 beacons, DNS tunneling, encrypted traffic anomalies, and protocol misuse without requiring hardware acceleration.
Event types	C2 communication, DNS tunneling, protocol anomalies

Rootkit Detector

Field	Details
Source	`rootkit-detector.ts`
Dependency	Linux
Capabilities	Checks for hidden processes (comparing `/proc` with `ps` output), hidden kernel modules, modified system binaries (checksum verification), and `LD_PRELOAD` injections.
Event types	Hidden processes, kernel module tampering, binary modification

Monitor Architecture

                    SecurityEvent
                         ^
                         |
  ┌──────────┬──────────┬──────────┬──────────┐
  |   Log    | Network  | Process  |   File   |    Built-in
  └──────────┴──────────┴──────────┴──────────┘
  ┌──────────┬──────────┬──────────┬──────────┐
  |  eBPF    |  Memory  |   DPI    | Rootkit  |  Advanced
  └──────────┴──────────┴──────────┴──────────┘

All monitors feed events into the MonitorEngine, which forwards them to the GuardEngine for DARE pipeline processing.

Advanced monitors are optional. Guard operates fully with built-in monitors alone. Enable advanced monitors when you need kernel-level visibility or have the required dependencies installed.

Products

Panguard Scan

Panguard Guard

Panguard MCP

Threat Cloud

Built-in Monitors

Log Monitor

Network Monitor

Process Monitor

File Monitor

Advanced Monitors

Syscall Monitor (eBPF)

Memory Scanner

DPI Monitor (Deep Packet Inspection)

Rootkit Detector

Monitor Architecture

​Built-in Monitors

​Log Monitor

​Network Monitor

​Process Monitor

​File Monitor

​Advanced Monitors

​Syscall Monitor (eBPF)

​Memory Scanner

​DPI Monitor (Deep Packet Inspection)

​Rootkit Detector

​Monitor Architecture

Built-in Monitors

Log Monitor

Network Monitor

Process Monitor

File Monitor

Advanced Monitors

Syscall Monitor (eBPF)

Memory Scanner

DPI Monitor (Deep Packet Inspection)

Rootkit Detector

Monitor Architecture