> ## Documentation Index
> Fetch the complete documentation index at: https://docs.panguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting to Threat Cloud

> How Panguard agents connect to Threat Cloud for collective threat intelligence.

Every Panguard agent connects to the public Threat Cloud automatically. No configuration, no API key, no account required.

## Default Connection

When you start Guard, it connects to `tc.panguard.ai` automatically:

```bash theme={null}
panguard guard start --dashboard
```

That's it. Your agent is now part of the collective intelligence network.

## What Happens Automatically

| Interval                | Action                                                                |
| ----------------------- | --------------------------------------------------------------------- |
| **On startup**          | Load bundled ATR rules from local install                             |
| **Every 1 hour**        | Sync with Threat Cloud: download new rules, upload anonymized threats |
| **On threat detection** | Submit anonymized event data to Threat Cloud                          |
| **On skill audit**      | Report safe/unsafe skill fingerprints                                 |

## Custom Endpoint

To point your agent at a different Threat Cloud instance:

```bash theme={null}
panguard guard start --threat-cloud https://your-server:8080
```

Or set the environment variable:

```bash theme={null}
export TC_ENDPOINT=https://your-server:8080
panguard guard start
```

Or in `~/.panguard/config.json`:

```json theme={null}
{
  "threatCloudEndpoint": "https://your-server:8080",
  "threatCloudApiKey": "your-api-key"
}
```

## Offline Mode

Guard works fully offline. If Threat Cloud is unreachable:

* Bundled ATR rules (768) continue to function
* Local AI (Ollama) handles analysis
* Events queue locally and sync when connectivity returns
* Protection never stops

```bash theme={null}
# Explicitly disable Threat Cloud sync
panguard guard start --no-cloud
```

## Private Instances

For organizations requiring isolated infrastructure or data sovereignty compliance, private Threat Cloud instances are available as a managed service.

<Card title="Contact for Private Instance" icon="envelope" href="https://panguard.ai/contact">
  Organizations can deploy dedicated Threat Cloud infrastructure with custom feeds, retention
  policies, and network isolation.
</Card>

## Verify Connection

Check your agent's Threat Cloud status:

```bash theme={null}
panguard status --json
```

```json theme={null}
{
  "threatCloud": {
    "connected": true,
    "endpoint": "https://tc.panguard.ai/api",
    "lastSync": "2026-03-13T08:00:00Z",
    "rulesReceived": 247,
    "threatsSubmitted": 12
  }
}
```

Or view it in the dashboard at `http://127.0.0.1:9100` (Threat Cloud page).