Console pages

Overview

• Shows: counts, device states and the latest findings. A value Guard has no report for reads Unknown, never zero.
• Do: open a tile or a device state to see what it counts.
• Fix: many Unknown devices means they have not reported recently. Check last contact in Devices.

Devices

• Shows: every enrolled device with its reported state, last contact, owner and coverage.
• Do: filter, then open Details for the device sheet: state and reason, what evidence is missing, owner, identifiers.
• Fix: Offline or Unknown means no recent report. Check the device's network and that it syncs. To change the owner, assign a person in the sheet.

Device health

• Shows: the sensor's own posture per device: the account it runs as, privileges, signature, data paths, offline store. Administrators only.
• Do: compare devices; a value the device did not report reads unknown.
• Fix: a growing offline store or quarantined items means the device cannot reach Guard Cloud. Fix its connection.

Investigations

• Shows: sensor findings, newest first, with severity, device, harness and evidence. Opening a device shows its evidence timeline.
• Do: filter by rule, severity, device or time. Open Evidence for what Guard saw, select findings and choose Create incident.
• Fix: for a finding that is noise, use Detection tuning. For one that is real, follow its guidance and create an incident.

Sessions and replay

• Shows: agent sessions that uploaded a step log, with steps, detections, losses and restarts.
• Do: open Replay to see prompts, tool calls, processes and detections in order. Administrators also see redacted excerpts when session content is on in Privacy.
• Fix: a session missing from the list has no step log. Install hooks that send a session ID, or run the endpoint sensor.

Incidents

• Shows: grouped findings with severity, state, assignee and history. Guard opens one for high and critical findings.
• Do: open an incident to triage it, assign it, add notes, merge, split or export evidence.
• Fix: if a change is rejected, someone else changed the incident first. Reload and apply it to the latest version.

Response

• Shows: commands to stop an agent's access, end its processes or isolate a device, with their history and results.
• Do: an operator or administrator issues a command with a reason. A pending command can be cancelled.
• Fix: a command the device has already received cannot be cancelled. Issue the matching release.

Policy

• Shows: signing mode, the published version, the catalog devices receive and every version with its author and approver.
• Do: start a draft and save it. Open a version to Preview impact against stored findings, then publish. Rollback creates a new version from an earlier one.
• Fix: a version marked with errors cannot be published. Open it and fix the listed errors. Remove a rule's draft line only after review.

Privacy

• Shows: what Guard collects, the opt-in switches, escalations and a privacy audit.
• Do: flip a switch. It acts at once and publishes. Session content is off by default; once it is on, its retention can be edited and keeps 30 days by default.
• Fix: to stop collection, turn the switch off. Every change appears in the privacy audit.

Detection tuning

• Shows: scoped exceptions, the detection gallery, suppressions and snippets.
• Do: from a finding or the gallery, choose Propose exception. Name the paths, commands or MCP servers, set an expiry and a reason, and preview the last 14 days. Suppress hides a detection's findings in the Console inbox only. The gallery shows each detection's severity band and marks your organization's published override. Snippets are ready-made rules to copy.
• Fix: an approved exception reaches devices only when the next policy version is published. Detections with no exception support need a rule change instead.

Staged rollout

• Shows: the catalog in force, how many devices fetched and applied it, and device groups.
• Do: create groups, move devices into them and open a device for its effective policy.
• Fix: a device that fetched but did not apply is not reporting. Check its sync and agent version.

Deployment

• Shows: install state per device, agent versions, enrollment tokens and install commands.
• Do: issue a token, optionally naming the device owner. A token enrolls one device, then stops. Copy it at once, it is shown once. Send it separately from the install command. Revoke a token you no longer want.
• Fix: enrollment failing means the token expired, was used or was revoked. Issue a new one.

Organization: Signing

• Shows: how policy is signed: managed by Guard Cloud, or local on an administrator's machine.
• Do: choose the signing mode. Turn on Require a second person to publish so an author cannot publish their own version.
• Fix: if publishing is refused, a different person must publish. Role defaults, settings and permissions are in the same section.

Console access

• Shows: Console access keys with role, status and creation time.
• Do: issue a key with a name and role, copy it at once, revoke keys that are no longer needed.
• Fix: if someone has too much access, revoke the key and issue one with the right role. Revoking ends its sessions.

Agents & posture

• Shows: agents from each device's latest inventory, with approval and inventory state.
• Do: open Profile for posture, MCP servers, findings, sessions and incidents.
• Fix: a device that never uploaded inventory is missing, not empty. Check that it syncs.

MCP & supply chain

• Shows: MCP servers as devices reported them, registry status, gateway adoption and definition changes.
• Do: filter to changed servers, open the change history, preview a block before you set it.
• Fix: only calls routed through the gateway are mediated. Route a server shown as unwrapped through it.

MCP activity

• Shows: gateway decisions per server and tool, as counts of calls and devices.
• Do: pick a window and filters, then open a server for its tools and daily calls.
• Fix: no activity does not mean no use. Devices that do not report are listed under coverage.

Credentials

• Shows: credentials by kind and name, where they are held, who owns them and their review and rotation. Never the value.
• Do: filter for no owner, shared, unused or inline. Mark reviewed or Record rotation.
• Fix: rotate a shared or inline credential and record it. Move inline ones out of files agents can read.

Shadow AI

• Shows: AI web apps seen on devices, from the browser extension and the network, with policy state.
• Do: open an app for its domains, state and alternative. Review requests list apps people asked to use.
• Fix: no evidence is not no use. Install the extension where coverage is missing.

Approvals

• Shows: requests from agents for an action that policy marks for approval.
• Do: check the action digest with the person on the device, then Approve or Deny with a reason. Approval covers that action once.
• Fix: a request that expired undecided needs the agent to ask again. Refresh to see new ones.

Assessments

• Shows: each device's latest assessment as severity bands, or a local report you open.
• Do: run guard assess --output report.json, then Choose report. It is read in your browser only.
• Fix: work through the report's failed checks, then assess again.

Programme

• Shows: programme numbers such as owned agents and incident timing, each marked available, partial or not available.
• Do: filter by operating system, window and trend.
• Fix: unowned agents need an owner. Assign people in People or in the device sheet.

Risk history

• Shows: one severity band per device and agent per day, for the organization and per device.
• Do: pick a window, then a device or agent.
• Fix: a missing day is unknown, not safe. It means nothing was recorded that day.

People

• Shows: the people who use your devices, kept in Guard Cloud when you have no directory.
• Do: add a person with a name and email, then assign their devices. Edit or change status.
• Fix: findings about an owner come from a suspended or deactivated person. Reassign their devices.

Integrations

• Shows: export destinations for your SIEM, delivery health, queue and dead letters.
• Do: administrators add a destination, Test it, edit it and retry dead letters.
• Fix: failing delivery shows the last error. Correct the endpoint or secret, then test again.

Audit log

• Shows: every security-sensitive action: sign-ins, access, policy, privacy, incidents, responses.
• Do: filter by action, actor, outcome and time.
• Fix: none needed. It is read-only, and secrets never appear in it.

Support cases

• Shows: your organization's cases with Runeward Labs support. Administrators only.
• Do: create a case with a subject, severity and description, reply and share chosen files.
• Fix: include the device and what you already tried.