Common tasks
Find procedures for onboarding, policy changes, findings, response, reporting, and retirement.
Common tasks connect configuration, verification, and recovery across Guard features. Start in the selected organization and confirm authority over every target.
Protect a new application
- Add its service asset at Assets → Add asset and assign its owner.
- Use Network protection → Services → Add service to verify ownership, configure TLS and origin health, and admit the traffic path.
- Stage WAF, rate limiting, and reputation rules in monitor mode, then publish reviewed enforcement.
- Confirm edge and origin observations before restricting direct-origin traffic. Test an application transaction after each routing change.
Add an employee device
At Endpoints → Enrollment, create a short-lived token for the pilot group and install the matching signed package on the device. Under Endpoint → Identity, compare its reported hardware and OS with inventory.
Check Endpoint → Capabilities for the required DLP channels and USB controls before assigning those policies. Under Endpoint → Policy, confirm the assigned revision is applied, then review Endpoint → Compliance for the current posture result. An inventory entry without agent reports is not an enrolled, reporting device.
Change an enforced rule
Open Policies → Policy → Edit draft, preview its targets and conflicts, and test the change on a pilot group. Publish and review Adoption. If the change fails, publish a new revision from the previous configuration and verify each affected executor; see policies.
Resolve a vulnerability
At Assessments → Findings → Finding, validate evidence and authentication basis, assign an owner, and apply the vendor-supported fix. Select Verify using the authorized scope. Resolution requires completed checks with sufficient coverage and no detection of the condition. A failed login leaves the finding unresolved. See remediation.
Contain and recover a device
At Incident → Response → Request action, select a supported containment action, review targets, and obtain required approval. Confirm acknowledged execution before recording containment. Request release or restoration separately after review, then verify endpoint state and application health. Use response actions and quarantine.
Export a security review
Use Reports → Create report with a fixed scope, period, and redaction level. Check the completed report's coverage gaps and cutoff before downloading. Evidence packages require separate permissions at Incident → Evidence → Export. See reports.
Retire a service or device
Migrate a service's DNS or route before Service → Decommission. Retire an endpoint, verify uninstall, and revoke its identity before deleting its asset. Review active response controls, holds, and retained records. Commercial cancellation at Organization → Billing does not perform these technical steps.