> ## Documentation Index > Fetch the complete documentation index at: https://docs.panguard.ai/llms.txt > Use this file to discover all available pages before exploring further. # Monitor Types > Reference for all 10 monitor types: 4 built-in and 6 advanced monitors with their capabilities and dependencies. The Guard agent supports 10 monitor types organized into two tiers. Built-in monitors are available on all platforms with zero dependencies. Advanced monitors require specific OS versions or external tools but provide deeper visibility. All monitors emit normalized `SecurityEvent` objects that feed into the DARE pipeline. ## Built-in Monitors These 4 monitors ship with `@panguard-ai/core` and work on macOS, Linux, and Windows out of the box. ### Log Monitor | Field | Details | | ---------------- | ------------------------------------------------------------------------------------------------------ | | **Source** | `core/monitors` | | **Platforms** | Linux, macOS, Windows | | **Data sources** | syslog (`/var/log/syslog`, `/var/log/auth.log`), Windows Event Log, application log files | | **Capabilities** | Reads and normalizes log entries to `SecurityEvent` format. Supports tailing for real-time monitoring. | ### Network Monitor | Field | Details | | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | **Source** | `core/monitors` | | **Platforms** | Linux, macOS, Windows | | **Data sources** | `/proc/net/tcp` (Linux), `netstat` (cross-platform) | | **Capabilities** | Monitors active network connections. Detects new connections, unusual ports, traffic to known-bad IPs, and anomalous connection patterns. | ### Process Monitor | Field | Details | | ---------------- | --------------------------------------------------------------------------------------------------------------- | | **Source** | `core/monitors` | | **Platforms** | Linux, macOS, Windows | | **Data sources** | `/proc` filesystem (Linux), OS APIs (macOS/Windows) | | **Capabilities** | Scans running processes. Detects new/unusual process spawning, suspicious command lines, and privilege changes. | ### File Monitor | Field | Details | | ---------------- | -------------------------------------------------------------------------------------------------------------------------- | | **Source** | `core/monitors` | | **Platforms** | Linux, macOS, Windows | | **Data sources** | inotify (Linux), FSEvents (macOS), ReadDirectoryChangesW (Windows) | | **Capabilities** | Watches critical filesystem paths for modifications. Tracks file creation, modification, deletion, and permission changes. | *** ## Advanced Monitors These 4 monitors ship with `@panguard-ai/panguard-guard` and provide kernel-level or specialized visibility. All gracefully degrade when their dependencies are not installed. ### Syscall Monitor (eBPF) | Field | Details | | ---------------- | --------------------------------------------------------------------------------------------------------------------------- | | **Source** | `syscall-monitor.ts` | | **Dependency** | Linux Kernel 4.18+ | | **Data source** | `/proc` polling for process and network activity | | **Capabilities** | Detects suspicious processes, privilege escalation attempts, and C2 (command-and-control) connections at the syscall level. | | **Event types** | Process creation, privilege changes, network syscalls | ### Memory Scanner | Field | Details | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Source** | `memory-scanner.ts` | | **Dependency** | `CAP_SYS_PTRACE` capability | | **Capabilities** | Scans process memory regions for fileless malware signatures, injected code, and suspicious memory patterns. Detects threats that never touch the filesystem. | | **Event types** | Memory injection, fileless malware, process hollowing | ### DPI Monitor (Deep Packet Inspection) | Field | Details | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Source** | `dpi-monitor.ts` | | **Dependency** | None (userspace implementation) | | **Capabilities** | Protocol-level traffic analysis. Detects C2 beacons, DNS tunneling, encrypted traffic anomalies, and protocol misuse without requiring hardware acceleration. | | **Event types** | C2 communication, DNS tunneling, protocol anomalies | ### Rootkit Detector | Field | Details | | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Source** | `rootkit-detector.ts` | | **Dependency** | Linux | | **Capabilities** | Checks for hidden processes (comparing `/proc` with `ps` output), hidden kernel modules, modified system binaries (checksum verification), and `LD_PRELOAD` injections. | | **Event types** | Hidden processes, kernel module tampering, binary modification | *** ## Monitor Architecture ``` SecurityEvent ^ | ┌──────────┬──────────┬──────────┬──────────┐ | Log | Network | Process | File | Built-in └──────────┴──────────┴──────────┴──────────┘ ┌──────────┬──────────┬──────────┬──────────┐ | eBPF | Memory | DPI | Rootkit | Advanced └──────────┴──────────┴──────────┴──────────┘ ``` All monitors feed events into the `MonitorEngine`, which forwards them to the `GuardEngine` for DARE pipeline processing. Advanced monitors are optional. Guard operates fully with built-in monitors alone. Enable advanced monitors when you need kernel-level visibility or have the required dependencies installed.