Use the Guard console
Find security views, target scope, policy adoption, investigation context, and change history.
The Guard console organizes work by security domain and selected organization. Use the organization selector before reading counts, changing policies, or exporting data.
Find a console view
Use these console areas for the corresponding security work:
| Console area | Use it for |
|---|---|
| Overview | Active incidents, coverage gaps, service traffic, and recent changes |
| Assets | Ownership, group membership, identities, and collector coverage |
| Intelligence | Indicators, campaign context, feed freshness, and sharing |
| Network protection | Protected services, edge policies, WAF, and attack traffic |
| Assessments | Scan scopes, schedules, findings, penetration tests, and reports |
| Endpoints | Agent health, compliance, DLP, USB controls, and quarantine |
| Access | VPNs, sites, applications, gateway health, and access sessions |
| Detections and Incidents | Triage, investigation timelines, evidence, and response |
| Policies | Drafts, published revisions, assignments, previews, and exceptions |
| Organization | Members, integrations, audit, retention, agreement, and billing |
Interpret counts and freshness
Filter by permitted asset group, time range, and source. Charts identify observation time and reporting delay. A zero after filtering means no matching retained observations; a missing collector or stale source is a coverage gap. Source clocks and delayed uploads can place ingestion and occurrence times in different windows.
Open an asset's Coverage tab to compare its expected collectors with their latest reports. A healthy management connection does not prove HTTP traffic traverses the edge or that a scanner authenticated successfully.
Make and inspect changes
Policy editors show a draft until Publish succeeds. The assignment preview shows affected assets and conflicts. After publication, open Policy → Adoption to inspect the requested and applied revisions by executor. Use Organization → Activity → Operations for accepted asynchronous work and Organization → Audit for attributable requests.
Destructive or disruptive controls show the target IDs and approval requirement before submission. A toast confirming acceptance is not an execution result. Open the linked operation or response action to verify outcomes.
Search and exports
Use the console search for names, resource IDs, indicators, and incident references within your permission boundary. Refine broad searches by organization and domain. Sensitive evidence fields are masked without the evidence grant; permission to see an incident title does not authorize downloading attachments.
For repeatable reporting, use Reports → Create report with a fixed time range and target list. A live dashboard changes as telemetry arrives; a completed report records its collection cutoff and coverage exclusions.