The things people ask us most, answered properly. Full deployment and administration documentation ships with your licence — and if the answer isn’t here, ask us directly rather than guessing.
Guardian Plus is an AI-powered unified monitoring and remote management platform that combines Nagios-style infrastructure monitoring with modern RMM capabilities. Unlike traditional tools that excel at either monitoring or management, Guardian Plus provides enterprise-grade capabilities in both areas through a single agent and unified web dashboard, with a service desk (Guardian PSA), a credential vault and knowledge base (Guardian Vault) and team chat (Guardian Comms) on the same platform. It features natural-language AI commands, visual workflow automation, browser-based terminal access, and works without requiring any open firewall ports on managed endpoints.
Signed installers are built per platform:
Each installer bundles its own runtime, so there is nothing to install first. There is no ARM Linux build, and distributions outside that list are not packaged — if yours matters, ask and we will tell you whether it is realistic.
No. Guardian Plus clients connect outbound to the central API server via WebSocket — no inbound ports required. This works in complex network environments with NAT, proxies and strict firewall rules. The client maintains a persistent WebSocket connection with a 10-second heartbeat, and all features (terminal, desktop, monitoring, commands) work through this single outbound connection over TLS.
Yes. We offer a 14-day free trial with full access to all Guardian Plus features including monitoring, RMM, browser-based terminal, remote desktop, AI commands and workflow automation. No credit card required to start. Start the trial →
Ask for what you want in plain language and Guardian Plus plans the work, shows you the plan, and executes it step by step:
Yes. Guardian Plus provides enterprise-grade monitoring comparable to Nagios or Datadog, plus RMM capabilities those tools don’t offer: it runs standard Nagios plugins and imports NagiosQL configs (auto-discovery replaces manual config), covers system metrics, service monitoring, custom checks and alerting, and adds browser terminal, remote desktop, patch management and script deployment — with natural-language commands and automated remediation on top.
A workflow is an automation you build visually: a graph of steps — run a command, run a script, branch on the result, ask the AI, open a ticket, notify someone — connected by conditions. Guardian Plus auto-generates monitoring for services it detects on a host (Apache, MySQL, systemd units, mounts, certificates), and each detected resource gets a check bound to a remediation action that can repair it. A MySQL workflow might check connectivity, query performance and replication status, then restart the service if it’s down and verify the fix. Workflows run on demand, on a schedule, automatically on each host, or in response to an alert — and can require approval before they touch anything.
Yes. Write remediation actions in Python for any monitoring need, with separate implementations for Linux, Windows, macOS or common cross-platform; add them to workflows; custom checks automatically register with the AI system; results carry status, metrics and optional remediation actions.
A genuine PTY on the far end — not a command runner — and real-time desktop viewing with keyboard and mouse control for macOS, Windows and Linux, all through the same outbound WebSocket tunnel. macOS requires the Screen Recording permission; Windows requires admin rights. Every session is TLS encrypted and audit-logged — operator, host, mode, start and stop.
Yes, for operating system updates across Windows, macOS and Linux: choose by category (security, critical, driver, feature, definition or optional) rather than approving updates one at a time; a reboot policy per job (never, automatically, on a schedule, or prompt the person using the machine); target one host, a list, or a saved fleet filter with a preview; live progress with installed and failed counts per run; run now or recurring daily, weekly or monthly in the timezone you choose. Patching covers operating system updates rather than third-party application catalogues.
Through AI commands (“run backup script on all production hosts”), workflows that execute scripts on groups of hosts, uploaded scripts executed via remediation actions, multiple terminal sessions, or host groups. Scripts can be Bash, PowerShell, Python, or any executable on the target platform.
The agent runs as a native service on each platform, installed from a signed package. Self-contained (each installer bundles its own runtime); outbound only (one authenticated TLS connection, nothing listens on a managed endpoint); always on (on macOS, monitoring continues whether or not a user is logged in); resilient (reconnects with backoff, detects sleep and wake, keeps working locally if the server is briefly unreachable); light (designed to stay out of the way on production machines).
Yes, and it is the normal way to run it. You will need a Linux host (Rocky, Ubuntu or SUSE — OS installers set up the runtime, database and web server for you; container images are also available), a database (provisioned by the installer, one per module), a domain and TLS certificate (agents connect over WSS, so a valid certificate is required), and outbound reachability from the endpoints you manage. The modules run on the Guardian Plus platform, which is part of every deployment and handles sign-in, your company structure and licensing. You install it alongside, not instead.
On each monitored host: the runtime is bundled in the installer; outbound HTTPS on port 443, no inbound rules; designed to sit quietly on production machines. API server: 2+ cores (4+ recommended for 100+ clients), 4 GB+ RAM (8 GB+ for 100+ clients), 50 GB+ SSD for database and logs, MariaDB 10.5 or later with InnoDB, runtime provisioned by the installer.
Deployments are sized to the estate rather than sold against a headline number. Sizing depends on how many endpoints you manage and how much you check on each; larger estates are served by additional servers rather than by clustering one; collectors distribute discovery, scanning and agentless checks across sites and networks; staggered execution prevents resource spikes; history is rolled up to 13 months at daily resolution, so storage stays predictable.
Yes — in transit every connection is TLS; at rest credentials, documents, ticket contents and integration secrets use AES-256-GCM with a fresh initialisation vector per record; keys are derived per company and per person for private vaults; on boot the service proves it can decrypt with the key it was given or exits; credentials injected into a remote session are resolved server-side and never reach the browser. One distinction that matters for a questionnaire: terminal and desktop sessions are relayed through the platform, so they are TLS-protected end to end but not end-to-end encrypted in the cryptographic sense. Shared credentials are decryptable server-side by design, because injection, break-glass and recovery all depend on it.
Anything secret is encrypted with AES-256-GCM before it reaches the database — vault credentials (passwords, secrets, SSH keys, one-time-password seeds and custom fields), integration secrets (vendor API keys and directory bind passwords), and agent keys held in the agent’s config file with owner-only permissions. Revealing one is an event: who, when, from where, and which permission allowed it — recorded before the secret is returned. Private vault items cannot be opened by any administrator, and the attempt is logged — enforced by policy and audit rather than by cryptography.
Everyone signs in once, through the platform: single sign-on covering every module; multi-factor with time-based one-time codes, with policy and grace periods you control; federation to Microsoft Entra or Okta over OpenID Connect (SAML is not supported), or user sync from Active Directory; agents authenticate with their own key; terminal and desktop use a password or SSH key for the target, or a credential pulled from the vault so nobody has to see it. Every sign-in and every failure is written to an authentication log that cannot be edited or deleted through any interface.
Yes, over LDAPS: users are created from Active Directory automatically on a schedule you set; someone removed from the directory is disabled here too; AD groups map to permission groups. Active Directory governs who exists and what they can do; signing in goes through the platform’s identity provider, which can itself federate to Entra or Okta.
Two units, and that is the whole model. Guardian RMM is priced by the devices you monitor; Guardian PSA and Guardian Vault by the people who use them. Guardian Comms is included with any licence. No feature tiers. Service level is separate — Self-Managed, Alliance (co-managed) or Full Service — the software is identical, what changes is how much of the work stays with you. Overage is a term you agree, not a surprise. Volume and commitment move the rate. Tell us what you manage →
Yes. Larger estates and longer commitments both price better — that is the main reason the rate depends on your situation rather than sitting on a public card. Tell us how many devices and people you are covering, which modules you want, and what term suits you, and we will be straight with you about where you land.
Yes — and it is the normal way to run it. Every deployment is single-tenant either way: there is no shared cloud instance. If you would rather not run it, we will host it for you on infrastructure dedicated to your organisation. Self-hosting is a deployment choice, not a licensing one — Guardian Plus is commercial software and the licence applies wherever it runs.
Webhooks to any HTTP endpoint; SMTP email; Slack, Microsoft Teams and Discord via webhook; carrier-grade SMS for critical alerts with per-user opt-in; QuickBooks Online for sending invoices and collecting against them; DocuSign for contracts; Bitdefender GravityZone managed from inside the console; Active Directory over LDAPS plus Microsoft Entra and Okta federation; a full REST API for anything we have not thought of. Custom integrations can also be built as workflows, using HTTP request and script steps — no middleware needed.
Guardian Plus collects and stores its own metrics and rolls them up to 13 months of history. A Prometheus-format scrape endpoint is available on the server for platform health metrics; the REST API can be queried for monitoring results; check results carry standard performance data. If Prometheus and Grafana are already central to how you work, raise it during evaluation.
Yes: a REST API with full CRUD for hosts, users, monitoring data and alerts; a WebSocket API for real-time data streaming and command execution; API key or JWT authentication; endpoints for hosts, monitoring checks, workflows, alerts, users and logs. The endpoint reference is available to customers on request.
Each agent writes a local log covering its connection state, workflow execution and any errors, and verbosity can be increased when you are chasing something specific. Exact locations differ per platform and are covered in the deployment documentation you get with your licence. Most of what you would go looking for is also visible centrally: connection history, command output and workflow runs are all in the console.
Documentation (complete guides, tutorials and this FAQ); bug reports and requests raised with support go to the engineering team directly; email support@guardianplus.ai for technical assistance; book a demo for personalised onboarding and training; professional services are available for self-hosted deployment and customisation. Include relevant logs and configuration details for faster resolution.
Can’t find the answer you’re looking for? Our team is here to help.