Backup and recovery
Back up management state and evidence, restore keys, and reconcile agents and edge state before automation.
A Guard backup preserves management records and referenced persistent artifacts. It does not back up protected applications or every endpoint's local quarantine store.
Create a recoverable set
An installation administrator first configures an independent destination and retention at Installation → Backups → Destination. Then use Installation → Backups → Create backup to capture the database and referenced artifact manifest.
Keep the release manifest, effective non-secret deployment configuration, and identity references with that recovery set. Store encryption-key recovery material through a separately protected key-recovery path so recovery does not depend on decrypting the failed installation's database.
Secrets and encryption keys need a separately protected recovery path. A database without the original decryption key can retain metadata while making scan credentials and integration secrets unusable. Do not put the only recovery key inside the encrypted backup that requires it.
Verify Backup → Integrity check and perform an isolated restore drill. A completed upload establishes that bytes were written; the isolated restore drill tests whether the recovery set is usable. Record database and artifact cutoffs, known gaps, and tested recovery duration.
Restore an installation
- Prepare isolated management infrastructure using the backed-up compatible release. Prevent both the old and replacement installations from issuing commands concurrently.
- Restore database, artifact objects, configuration, and required keys from one recovery set using the bundle's recovery workflow. Keep response automation paused.
- Open Installation → Recovery → Reconcile. Compare retained operations with current agent, gateway, and edge state. Mark ambiguous actions for review rather than replaying them blindly.
- Verify identities, evidence digests, policy adoption, feed freshness, and schedules. Expired response actions remain expired.
- Reconnect protected services and SOC collaboration under reviewed ownership. Enable automation only after the recovery owner approves the reconciled state.
During Installation → Recovery → Reconcile, compare each target's assigned revision in the restored database with its reported applied revision. If they differ, review the operation history before publishing a replacement policy. Keep response automation paused until the recovery owner approves that choice. Release isolation or reinstate access only through a new authorized action.
Loss and deletion boundaries
An endpoint lost or wiped before its quarantine artifact was exported might be unrecoverable from the control-plane backup. External notifications and downloaded reports have their own copies. Restore tests must account for holds and retention, including backups that outlive live records.
See upgrades for schema compatibility and troubleshooting for unavailable keys or missing artifacts.