Aegis Guard
Kill, quarantine, isolate, and prove coverage — Falcon Go–class controls without Threat Graph theater. Sold as Guard standalone or included in Aegis One Complete with MDM + MFA.
How Guard fits
Defender is the detection engine. Guard is the response plane — operators contain risk without leaving the console.
Realtime threats, canaries, and integrity signals land in Guard with a live protect score.
Kill, quarantine, isolate, USB deny, and desk contain — with management paths kept alive.
Evidence rows, false-positive workflow, and restore when a sample is clean.
What ships
Every control below is in the product. Marketing claims live here; the operator console runs the same protect plane.
Defender Operational threats feed the Guard loop. Operators see detect, kill, and contain signals with a live score.
Contained files land in inventory. Restore from the console when a sample is a false positive — not a ticket black hole.
Cut lateral movement while keeping management paths alive — DNS and Guard/API hosts stay on the allow-list.
Local decoys trip before encryption runs wild — including offline desks where cloud hunting never sees the first write.
How you buy
Same protect plane either way. Choose Guard alone, or run it inside Aegis One Complete with MDM + Windows Logon MFA.
Protect SKU
Desk response for Windows: detect, kill, quarantine, isolate, score.
Platform
Guard included with MDM + MFA — one seat for fleet, logon, and protect.
Honest scope
Falcon Go–class desk controls. Defender is the detection engine. No Threat Graph theater.
Same SKU. Same API. Operator desk at /console/.
