---
title: 'panguard guard'
description: 'Manage the real-time endpoint protection agent.'
icon: 'shield'
---

The `guard` command controls Panguard's real-time protection agent -- a three-layer AI pipeline that monitors your system continuously, detects threats, and responds automatically. Guard runs as a background service and reports events through your configured notification channels.

## Usage

```bash
panguard guard <subcommand> [options]
```

## Subcommands

| Subcommand  | Description                                           |
| ----------- | ----------------------------------------------------- |
| `start`     | Start the Guard agent                                 |
| `stop`      | Stop the running Guard agent                          |
| `status`    | Show current Guard status and statistics              |
| `install`   | Install Guard as a system service (systemd / launchd) |
| `uninstall` | Remove the Guard system service                       |
| `config`    | View or modify Guard configuration                    |
| `help`      | Show Guard subcommand help                            |

## Options

<ParamField path="--data-dir" type="string">
  Override the default data directory where Guard stores logs, baselines, and state files. Defaults
  to `~/.panguard/guard/`.
</ParamField>

## Examples

<CodeGroup>
```bash Start Guard protection
panguard guard start
```

```bash Check Guard status
panguard guard status
```

```bash Install as system service
panguard guard install
```

```bash Use custom data directory
panguard guard start --data-dir /opt/panguard/data
```

```bash Stop Guard
panguard guard stop
```

```bash View Guard configuration
panguard guard config
```

</CodeGroup>

## How It Works

Guard operates through three layers of AI processing:

1. **Layer 1 -- Rule Engine** -- ATR rules for known threat patterns
2. **Layer 2 -- Behavioral AI** -- Machine learning baselines detect anomalous process, network, and file activity
3. **Layer 3 -- LLM Judgment** -- Large language model correlates events, judges severity, and generates plain-language alerts

<Tip>
  After starting Guard, it enters a **learning mode** for the first 24 hours to establish behavioral
  baselines. During this period, you may see more informational alerts than usual.
</Tip>

## Related

<CardGroup cols={2}>
  <Card title="Guard Product Overview" icon="shield-check" href="/products/guard/overview">
    Architecture and design of the Guard agent.
  </Card>
  <Card title="Agent Pipeline" icon="diagram-project" href="/products/guard/agent-pipeline">
    Deep dive into the three-layer AI processing pipeline.
  </Card>
  <Card title="Guard Configuration" icon="gear" href="/configuration/guard-config">
    Customize monitors, thresholds, and auto-response rules.
  </Card>
</CardGroup>
