Get started with Guard

Establish an organization, protect a pilot asset, and verify observations and response.

Guard protects public services, employee devices, and private applications through policies attached to an organization's assets. Start with one service or a small device group, verify coverage, and expand after testing recovery.

Prepare access and ownershipCopy link

An organization Owner creates the organization through the Guard console supplied with the subscription. Open Organization → Members → Invite member to add an Administrator and an Analyst. Configure roles and SSO, record an emergency contact at Organization → Contacts, and review service coverage before production onboarding.

For an installation you operate, complete self-hosting first. Select the organization in the console header; all console paths in this guide start inside that organization.

Build a pilot inventoryCopy link

1. Open Assets → Add asset. Select service, device, or network, give it an owner, and enter the hostname or address used to identify it.
2. Open Assets → Groups → Create group and create pilot. Add the asset explicitly. A group selects targets; membership does not grant user access.
3. Under Policies → Baselines, review the organization baseline. Create a pilot assignment in monitor mode before enabling blocking. Check policy precedence when another group already selects the asset.

An inventory record is not evidence of active protection. Its Coverage view lists the separate traffic, endpoint, assessment, and access collectors and their latest observations.

Connect a protection pathCopy link

For a public application, use Network protection → Services → Add service, verify the domain, configure its origin, and follow traffic onboarding. For a device, use Endpoints → Enrollment → Create token, install the signed package shown for its platform, and follow endpoint enrollment. A private application uses ZTNA; it does not acquire public DDoS coverage by appearing in inventory.

Verify a complete workflowCopy link

1. Open Assets → Asset → Coverage. Confirm the expected executor reports recent observations and its applied policy revision matches the assignment. For a missing report or revision mismatch, use troubleshooting before expanding the pilot.
2. At Policies → Policy → Test, run a non-destructive policy test against the pilot asset.
3. In Detections, open the resulting observation and link it to a test incident. Check its asset ID and rule revision against the pilot configuration.
4. At Organization → Integrations → Integration → Test delivery, send a synthetic notification. Confirm the delivery result and receipt at the intended destination. If delivery fails, inspect Integration → Deliveries and correct the recorded receiver error.

Check the test event's source and whether it was observed or blocked. Delivery to Slack does not prove a device was isolated. Perform any containment test on the pilot device with a working recovery path, using response actions.

Expand coverageCopy link

Add owners and group assignments, authorize scanning, and agree the penetration-testing scope. Review Organization → Billing → Agreement for coverage allowances. Use common tasks for ongoing work and troubleshooting when an asset remains unprotected.