Aegis Guard
Kill, quarantine, isolate, and prove coverage — Falcon Go–class controls without Threat Graph theater.
What ships
Every control below is in the product. Marketing claims live here; the operator console runs the same protect plane.
Defender Operational threats feed the Guard loop. Operators see detect, kill, and contain signals with a live score.
Contained files land in inventory. Restore from the console when a sample is a false positive — not a ticket black hole.
Cut lateral movement while keeping management paths alive — DNS and Guard/API hosts stay on the allow-list.
Local decoys trip before encryption runs wild — including offline desks where cloud hunting never sees the first write.
Removable storage deny pairs with Defender ASR for script and Office macro control — desk lockdown when risk appears.
On-demand Defender scan from the console. Software integrity alarms for crack tools and unsigned installers from Downloads/Temp/Desktop — full path on the threat row.
Full list
Compact map of what buyers ask for. Deep table on the features page.
Defender realtime protection + Attack Surface Reduction.
Canaries · kill · isolate — including offline desks.
Guard portal stats, recent events, live score.
Agent kill path for suspicious processes.
Inventory API and restore command in console.
Allow-list DNS + management HTTPS while cut off.
Defender-backed quick scan from the operator desk.
Mass-storage deny via Aegis One MDM when licensed.
Defender ASR policy evidence and enforcement.
TamperProtect + Guard registry hardening.
Mark FP in console with audit trail.
Crack/keygen block; unsigned installer path alarms.
Honest scope
Falcon Go–class desk controls. Defender is the detection engine. No Threat Graph theater.
Same SKU. Same API. Operator desk at /console/.
