Worker, feed, SOC, and Connector settings
Reference background execution, retention, scanner identity, and enabled service connections.
Worker and connection settings control independent services. Restart the named consumer after changing a value; shared parsing rules reject invalid types and conflicts.
Worker and retention
These variables configure job concurrency, scanner identity, and initial retention:
| Variable | Consumer | Default or requirement | Type, bounds, and behavior |
|---|---|---|---|
GUARD_WORKER_CONCURRENCY | Worker | 4 | Integer 1–64 concurrent jobs; raising it does not raise scanner target authorization |
GUARD_SCAN_CONCURRENCY | Scanner | 2 | Integer 1–32 concurrent targets, further limited by the scope's approved intensity |
GUARD_SCANNER_IDENTITY_FILE | Scanner | Required | File-only issued scanner identity; enrolled through Assessments → Scanners |
GUARD_SCANNER_CONTROL_URL | Scanner | Required | HTTPS Guard origin; agent-style reporting transport, not a management API token |
GUARD_ALERT_RETENTION_MONTHS | Worker bootstrap | 13 | Integer 13–84 calendar months; initializes default alert/log retention for new organizations |
GUARD_EVIDENCE_RETENTION_DAYS | Worker bootstrap | Required | Integer 1–3650 days; initializes raw-evidence retention; organization changes are audited |
GUARD_QUARANTINE_RETENTION_DAYS | Worker bootstrap | 30 | Integer 1–365 days; initial local-quarantine policy; agent adoption is separate |
GUARD_CLEANUP_INTERVAL_SECONDS | Worker | 3600 | Integer 60–86400 seconds between eligible-data cleanup passes; holds still apply |
Bootstrap retention settings do not shorten an existing organization's policy on restart. Effective retention is visible at Organization → Data → Retention. Cleanup has independent persistence effects; reducing an interval does not authorize deletion of held records. Scanner identity and state must not be cloned onto concurrent active scanners.
Feed synchronization and SOC collaboration
These variables configure independently enabled feed and SOC connections:
| Variable | Consumer | Default or requirement | Type, bounds, and dependencies |
|---|---|---|---|
GUARD_FEED_ENABLED | Feed worker | true | Boolean; disabled mode marks feed freshness unavailable |
GUARD_FEED_URL | Feed worker | Required when enabled | Assigned HTTPS feed endpoint; no customer-guessed hostname |
GUARD_FEED_TOKEN_FILE | Feed worker | Required when enabled | File-only feed credential, distinct from API keys |
GUARD_FEED_INTERVAL_SECONDS | Feed worker | 900 | Integer 60–1800 seconds between refresh attempts; outages can exceed freshness targets |
GUARD_SOC_ENABLED | Collaboration worker | false | Boolean; organization consent and category selection are also required |
GUARD_SOC_URL | Collaboration worker | Required when enabled | Assigned HTTPS collaboration endpoint |
GUARD_SOC_IDENTITY_FILE | Collaboration worker | Required when enabled | File-only collaboration identity, limited to approved shared telemetry |
Disabled services do not attempt network connections; their optional settings are still type-validated when supplied. Enabling SOC transport does not itself approve organization data sharing. Review Organization → SOC → Collaboration for consent, queued events, freshness, and disconnection gaps.
DDoS Connector
These variables configure the self-hosted connection to the Solarius edge:
| Variable | Consumer | Default or requirement | Type, bounds, and behavior |
|---|---|---|---|
GUARD_CONNECTOR_CONTROL_URL | Connector | Required | HTTPS self-hosted Guard origin |
GUARD_CONNECTOR_EDGE_URL | Connector | Required | Assigned HTTPS Solarius edge management endpoint |
GUARD_CONNECTOR_IDENTITY_FILE | Connector | Required | File-only enrollment identity bound to the approved organization and installation |
GUARD_CONNECTOR_STATE_DIR | Connector | /var/lib/guard-connector | Absolute writable persistent path; includes cached admitted configuration |
GUARD_CONNECTOR_SYNC_SECONDS | Connector | 15 | Integer 5–300 seconds between reconciliation attempts |
The Connector is deployed only when required for self-hosted DDoS protection. Its service is absent when disabled in the bundle; there is no implied global switch that disables unrelated endpoint, scan, or access services. Preserve its identity and state during restart. A replacement installation requires reviewed identity reconciliation, not a copied active credential.