# Product Overview

> AI-Driven Adaptive Endpoint Protection

---

## What is Panguard AI?

Panguard AI is an open-source cybersecurity platform designed for developers and small businesses who don't have a security team.

The core idea is simple: **install, and AI protects your machines automatically. It tells you when something happens. When nothing happens, you do nothing.**

### User Experience

Like Claude Code:

1. **Install** - One command install, zero configuration
2. **CLI** - `panguard guard start` begins protection immediately
3. **Usage** - Zero daily operation required

### Why Panguard AI?

Traditional security tools:

- Require expertise to install and configure
- Interfaces full of security jargon (IOC, MITRE ATT&CK, etc.)
- Generate thousands of alerts with no prioritization
- Enterprise tools cost six figures; free alternatives are hard to use

Panguard AI:

- **One command install**, zero configuration
- **Plain language notifications** via Telegram / Slack
- **AI auto-judges** severity and executes responses
- **Gets smarter over time**, learning from your environment

---

## Product Suite

Panguard AI includes 6 products. Each works independently, but together they form a complete SOC in one command.

### Panguard Scan - 60-Second Security Audit

One-time security scan that produces a risk score and PDF report.

```bash
panguard scan --quick
```

- System discovery (OS, network, ports, services)
- Password policy audit
- Firewall status check
- SSL/TLS certificate validation
- Risk score 0-100 (grades A-F)
- PDF report with remediation + compliance mapping

Best for: initial assessment, periodic health checks, pre-audit preparation.

[Guide ->](guides/scan.md)

---

### Panguard Guard - AI Real-Time Monitoring

Always-on AI protection engine that detects and responds to threats automatically.

```bash
panguard guard start
```

- 4-agent AI pipeline: Detect -> Analyze -> Respond -> Report
- 7-day learning period builds behavioral baseline
- 101 ATR rules with 520 detection patterns
- Real-time threat intelligence (ThreatFox / URLhaus / GreyNoise)
- Auto-response: IP blocking, file quarantine, process termination
- Investigation engine for root cause analysis

Best for: server protection, VPS, office endpoint monitoring.

[Guide ->](guides/guard.md)

---

### Panguard Chat - AI Security Notifications

Translates technical security alerts into plain language and delivers them through your preferred channel.

```bash
panguard chat setup --channel line --user-type boss
```

- 5 notification channels: Telegram, Slack (Block Kit), Email (SMTP/HTML), Webhook (mTLS), LINE
- 3 tone modes:
  - **boss** - Impact summary, plain language
  - **developer** - Technical details, CLI commands and logs
  - **it_admin** - Remediation steps, step-by-step instructions
- Bilingual templates (English / Traditional Chinese)

Best for: everyone. Guard detects threats, Chat tells you about them.

[Guide ->](guides/chat.md)

---

### Panguard Trap - Smart Honeypots

Deploy decoy services to lure attackers, collect intelligence, and profile their behavior.

- 8 honeypot services: SSH, HTTP, FTP, SMB, MySQL, RDP, Telnet, Redis
- Attacker profiling: skill level classification (script kiddie / intermediate / APT)
- Credential collection and command logging
- Intent analysis
- Threat intelligence reports
- All honeypots fully isolated from production

Best for: understanding who's attacking you, their intent and skill level.

[Guide ->](guides/trap.md)

---

### Panguard Report - Compliance Reports

Auto-generate audit-ready compliance reports in 60 seconds.

```bash
panguard report --framework iso27001
```

| Framework                        | Controls    | Languages  |
| -------------------------------- | ----------- | ---------- |
| Taiwan Cyber Security Act (TCSA) | 10 controls | EN + zh-TW |
| ISO/IEC 27001:2022               | 30 controls | EN + zh-TW |
| SOC 2 Trust Services             | 10 controls | EN         |

- Executive summary with security score
- Control-by-control assessment
- Evidence packages with timestamps
- Remediation recommendations
- JSON, Markdown, and PDF output

> Reports assess readiness, not certification. They prepare you for formal audits.

Best for: mid-size companies needing compliance, audit preparation, enterprise sales.

[Guide ->](guides/report.md)

---

### Threat Cloud - Collective Threat Intelligence

Anonymized threat intelligence sharing. Every Panguard user strengthens the network.

```bash
panguard threat start --port 8080
```

- RESTful API server with SQLite backend
- IoC (Indicator of Compromise) submission and queries
- Automatic ATR rule generation from real attacks
- IP/domain reputation scoring
- Rate limiting and API key authentication
- Encrypted transport (TLS 1.3)

Privacy: only anonymized threat signatures leave your machine. Zero raw data. Zero telemetry. Can be turned off anytime. Fully functional offline.

Best for: private enterprise deployment, community threat intelligence sharing.

[Guide ->](guides/threat-cloud.md)

---

## Architecture

```
                         User
                          |
                    [panguard.ai]
                 Sign up / Manage
                          |
                    [panguard login]
                      CLI auth
                          |
    +---------------------+---------------------+
    |                     |                     |
[Panguard Scan]    [Panguard Guard]      [Panguard Report]
  60s audit        AI monitoring          Compliance
    |              |         |                |
    |         [4 Agents] [Baseline]          |
    |              |                         |
    +------[Panguard Trap]------+             |
           Honeypots                         |
                |                            |
           [Threat Cloud] ------ Collective Intelligence
```

### Three-Layer AI Funnel

| Layer   | Technology        | Handles | Latency | Cost        |
| ------- | ----------------- | ------- | ------- | ----------- |
| Layer 1 | ATR rules engine  | 90%     | < 50ms  | $0          |
| Layer 2 | Local AI (Ollama) | 7%      | ~2s     | $0          |
| Layer 3 | Cloud AI          | 3%      | ~5s     | $0.008/call |

Cloud down? Local AI takes over. Local AI down? Rules engine keeps running. Protection never stops.

[Learn more ->](concepts/three-layer-ai.md)

---

## Tech Stack

| Category   | Technology                               |
| ---------- | ---------------------------------------- |
| Language   | TypeScript 5.7 (strict mode)             |
| Runtime    | Node.js 20+                              |
| Monorepo   | pnpm 10 workspaces                       |
| Testing    | Vitest 3 (3,017 tests / 142 files)       |
| Rules      | ATR (101 rules, 520 patterns)            |
| AI         | Ollama (local) + Claude / OpenAI (cloud) |
| Auth       | Google OAuth (PKCE) + scrypt hashing     |
| i18n       | English + Traditional Chinese            |
| Encryption | AES-256-GCM                              |

---

## Open Source

Panguard AI is released under the [MIT License](https://github.com/panguard-ai/panguard-ai/blob/main/LICENSE).

Full source code. Zero black boxes. Every line auditable.
