Security Monitoring¶

Guance integrates CSPM and SIEM to build a unified security monitoring system covering "assets → configurations → behaviors", achieving full coverage from static configuration risks to dynamic threats.

Core Capabilities¶

SIEM¶

Focuses on "activity behavior" security in the runtime environment.

Core problem solved: Are malicious or abnormal activities occurring in the environment?

✅ Real-time collection and analysis of various log data (e.g., operating system logs, network traffic, cloud platform operation audit logs), using rules and threat detection models, designed to detect and respond to "dynamic" security threats that have occurred or are ongoing.

Its core value lies in threat discovery and incident response, applicable to security monitoring, intrusion detection, and incident investigation scenarios.

CSPM¶

Focuses on the "configuration state" security of cloud infrastructure.

Core problem solved: Are cloud resources properly configured from the start?

✅ Through automated policies, continuously scan the configuration of cloud platforms and their services (e.g., storage bucket public access, security group rules, IAM policies), designed to prevent and discover "static" security vulnerabilities and compliance deviations caused by configuration errors.

Its core value lies in risk prevention and governance, applicable to security hardening and compliance audit scenarios.

ABA¶

Focuses on "behavior risk" security of AI Agent runtime.

Core problem solved: Are there abnormal or high-risk behaviors during AI Agent execution?

✅ By collecting and analyzing the behavior data of AI Agent during runtime, using rules and risk detection models, designed to detect and respond to risky behaviors such as abnormal operations, unauthorized access, and sensitive data leakage that occur during Agent execution.

Its core value lies in the visibility and risk control of AI Agent behaviors, applicable to AI security audit and Agent behavior compliance monitoring scenarios.

Use Cases¶

• Cloud storage bucket leak monitoring
• Internal data violation access
• Malicious file upload detection
• Infrastructure misconfiguration
• Unauthorized access
• Insecure interfaces/APIs
• Compliance and regulatory issues
• ......

Getting Started¶

1. Create detection rules

In the console, create security detection rules, customize the detection frequency, detection interval, event title and description, and associate alert strategies.

1. Execute detection and generate events

After the rule is successfully created, the system will execute detection according to the set rules. When the detection result matches the rule logic, the system generates corresponding events.

1. Event handling and notification

The system will determine whether the event meets the trigger conditions of the associated alert strategy:

• Condition met: Send alert notification

• Condition not met: Only record the event, no notification

• Signal viewing and analysis

For such raw indicators or events generated from various data sources that may indicate potential security threats, unified visualization and analysis can be performed through signals.

In the signal explorer, efficiently process these massive signals using features such as quick filtering and search, transforming them from "cluttered information requiring manual screening" into "clear alerts for prioritized processing."