Continuous baseline
Learns normal LAN and server patterns for the premises, then flags deviations worth a human look.
What Guard watches
- Network activity — device joins, unusual ports, bursty talkers, off-hours traffic patterns
- Server activity — containers and services on the Vault host; health and odd process behavior
- Reachable servers — optional monitoring of machines on the LAN the gateway can see
- Alerts — operator-facing notices when something leaves the baseline you accept
Guard runs on your appliance. Telemetry stays under your custody model — it is not a third-party cloud SIEM product you rent by the seat.
Actionable alerts
Surface odd DHCP clients, unexpected outbound paths, container restarts, and admin-path anomalies.
Operator control
You decide response: quarantine a device path, restart a container, or escalate to your admin.
Stack-aware
Understands the privatized MD Hub services on the box so platform noise is separated from real risk.
Included with the hardware
AI Guard ships as part of the MD Vault Gateway SKU. It is not sold as a standalone download. Wi‑Fi repeaters extend radio coverage; Guard still sees the traffic that flows through the parent gateway.