24/7 AI endpoint protection. One command to install.

5-Agent AI Pipeline

Events flow through 5 specialized AI agents: Detect (Sigma/YARA rules + local LLM), Analyze (threat classification), Respond (auto-remediation), Report (compliance documentation), and Chat (human notification). 90% of events handled at zero cost by rules alone.

3 Auto-Response Types

High-confidence threats are neutralized automatically via three response modules: IP Blocker (firewall rules), Process Killer (malicious process termination), and File Quarantine (suspicious file isolation). Every action is logged and reversible.

4 Notification Channels

Get alerts where you already are: LINE, Telegram, Slack, and Email. Each channel supports rich formatting with threat details, severity badges, and one-click remediation links.

Confidence Scoring

Every event receives a 0-100 confidence score. Scores above 85 trigger auto-response. 50-84 sends a notification. Below 50, the event is logged and fed into the learning system.

Graceful Degradation

Cloud AI down? Local LLM (Ollama) takes over. LLM offline? The rule engine with 3,155 Sigma and 423 YARA rules handles it. Guard never stops protecting, regardless of network conditions.

7-Day Context Memory

Seven-day learning period builds a behavioral baseline for your specific system. After that, any deviation is flagged with context. The baseline continuously refines itself over time.