Quick Start

Cloud SaaS Setup

The fastest way to start. No server required.

1. Visit guardfoxsecurity.com and click Start Free Trial
2. Create your account — choose your organisation name
3. Your subdomain is provisioned instantly: portal.guardfoxsecurity.com
4. Log in with your credentials
5. Go to Administration → Data Sources to connect your first SIEM connector
6. Install your first EDR agent on an endpoint (see Agent Installation below)

Self-Hosted Setup

Run GuardFox Security Systems on your own infrastructure — a VPS, a home machine, or anything that can run Docker.

Note: the source repository is private. Request access and we'll grant you a collaborator invite — the steps below assume you already have it.

Prerequisites

• Docker Desktop (Windows/Mac) or Docker Engine (Linux)
• 4 GB RAM minimum, 8 GB recommended

Local dev vs. running the whole app in Docker

There are two separate Compose files, for two different purposes — don't mix them up:

• docker-compose.yml — Postgres only, for local development where you run npm run dev directly on your machine and just need a database.
• docker-compose.prod.yml — the whole app, built from frontend/Dockerfile and run via its own custom Node server (not next start — a raw http.Server wrapper that accepts the EDR agent's WebSocket connections), plus its own Postgres. This is what you actually want for self-hosting.

Self-hosting with Docker Compose

git clone https://github.com/Hack2Report/guardfox-security-systems
cd guardfox-security-systems
cp frontend/.env.example .env.prod
# Edit .env.prod: set POSTGRES_PASSWORD, NEXTAUTH_SECRET (openssl rand -base64 32),
# and NEXTAUTH_URL to your real domain
docker compose -f docker-compose.prod.yml --env-file .env.prod up -d --build

Migrations run automatically on container start. Seeding does not — run it once after the first start to create the initial admin login and the 4 built-in Module Roles (see Roles & Access):

docker compose -f docker-compose.prod.yml --env-file .env.prod exec app npx tsx prisma/seed.ts

The seeded accounts' default passwords are printed to the container logs — change them immediately after first login.

Exposing it to the internet

If you're hosting on a machine without a public IP (e.g. a home server), a Cloudflare Tunnel gets you a real domain with TLS and no router port-forwarding: install cloudflared, run cloudflared tunnel login, create a tunnel, route your domain's DNS to it, and point its ingress config at http://localhost:3000. On a VPS with its own public IP, a plain DNS A record pointing at the box is enough.

Access

Open http://localhost:3000 (or your domain, once DNS/tunnel is set up) after startup.

Installing the EDR Agent

Windows (PowerShell — run as Administrator)

# Replace YOUR_API_KEY with the key from Settings → Agent Keys
$env:GuardFox_API_KEY = "YOUR_API_KEY"
$env:GuardFox_SERVER  = "https://portal.guardfoxsecurity.com"
Invoke-WebRequest "$env:GuardFox_SERVER/install-agent.ps1" | iex

Linux (bash)

curl -sSL https://portal.guardfoxsecurity.com/install-agent.sh |   GuardFox_API_KEY=YOUR_API_KEY bash

macOS

curl -sSL https://portal.guardfoxsecurity.com/install-agent-mac.sh |   GuardFox_API_KEY=YOUR_API_KEY bash

The agent starts automatically and appears in Endpoint (EDR) → Agent Portal within 60 seconds.

What the agent does

• Sends heartbeat every 30 seconds
• Streams process, file, network, and registry events
• Runs YARA scans only when dispatched via the API, on Linux and macOS, against a process's on-disk image — never automatically, never against memory, and only with a ruleset you supply (none ships with the product). The Windows agent has no YARA support.
• Monitors PowerShell script block logs
• Protects VSS shadow copies from deletion
• Supports remote quarantine and forensic collection

Finding Your Way on Day One

GuardFox is a large platform. A few things make the first hour easier:

Get-started checklist

Your dashboard shows a Get started card that tracks the four steps that matter on day one — connect a data source → enroll your first agent → invite your team → see your first alert. Each step links straight to where it's done, ticks itself when complete, and the card retires once you're set up.

Sample-data banner

A new workspace is seeded with sample data so nothing is empty while you evaluate. A "Sample data — you're exploring a demo environment" banner sits at the top so you always know these numbers aren't your real environment yet. It clears when you connect a real data source, or click "This is real data."

In-app help

Press ? anywhere (or click the ? in the header) to open a searchable help panel — task shortcuts and a glossary of security acronyms (KEV, IOC, EDR, C2, DGA…).

Jargon

Dotted-underline terms across the UI reveal a plain-language definition on hover or keyboard focus.