Compliance Checks
Guardian evaluates every agent in your fleet against a set of compliance rules, maps the results to industry framework controls, and flags unusual behavior with statistical anomaly detection. All of this lives on the Compliance page, organized into three tabs.
Agent Compliance
Section titled “Agent Compliance”Each agent gets a compliance score (0–100) based on how many rules pass, fail, or warn. The summary bar at the top shows fleet-wide totals: total agents, compliant, non-compliant, unknown (not yet evaluated), and critical failures.
Expand any agent to see its individual rule results — rule name, severity, a detail message, and when it was last checked.
Select one or more agents with the checkboxes to re-evaluate just those, or use Re-evaluate All to run checks across the whole fleet. Automatic evaluation also runs every 6 hours. Triggering an evaluation requires an admin role — see Users & Roles.
Compliance Frameworks
Section titled “Compliance Frameworks”This tab maps your automated check results to SOC 2 and PCI-DSS controls. For each control, Guardian shows which of its automated checks back it (for example, patch currency, CVE exposure, or endpoint monitoring coverage) and a status badge:
| Status | Meaning |
|---|---|
| Compliant | All evaluated agents pass |
| Partially evaluated | Mixed results |
| X failing | One or more agents fail this control |
| Not yet evaluated | No data yet — run an evaluation |
This is evidence for an audit, not a certification — it documents only the subset of technical controls Guardian can verify automatically. Controls with no automated check behind them aren’t shown.
Click Export Evidence PDF on any framework to download a report listing each control, its description, the checks behind it, and current fleet status. Hand this to an auditor as supporting evidence.
Anomalies
Section titled “Anomalies”Guardian builds a rolling 7-day statistical baseline of CPU and memory usage for each agent. When a reading deviates more than 2.5 standard deviations from that baseline, an anomaly is logged — this catches problems fixed thresholds miss, like a server that normally runs hot suddenly going idle.
Each anomaly entry shows the metric, the agent, the observed value versus baseline, the deviation in standard deviations, and severity. Some anomalies include an AI-generated explanation. Baselines take 7 days of data collection to build, so new agents won’t show anomalies immediately.