Description
Position 03 · Protect
Spots the threat, then shuts it down.
Guard turns CombineRMM into a detection and response platform. Guard plays slot into every Playbook, and offline devices queue actions until they reconnect.
Ransomware canaries
Hidden decoy files in the folders that matter. If one is encrypted or renamed, a critical alert fires within seconds and Guard can isolate the device.
Persistence watch
New launch agents, Run keys, services and cron jobs flagged as they appear, with signing status and MITRE ATT&CK mapping.
Antivirus health
Defender, XProtect and third-party EDR checked continuously. “No active antivirus” opens a case.
One-click response
Isolate the network, quarantine or retrieve a file, kill a process tree, or collect triage.
App control
Audit what runs, allow it in one click, then enforce. On Linux, unapproved programs are blocked before they start.
USB storage control
Audit, read-only or block, with exceptions by drive serial number. Keyboards and docks keep working.
Just-in-time admin
Users request admin from the tray. You approve a time-boxed grant that expires even if the device is offline.
Threat intel built in
About 1.1 million malware hashes and 100K network IOCs from abuse.ch power detection and network blocking.
Founding Supporter pricing · limited time
| Guard per endpoint, monthly | |
| Guard per endpoint, annual | |
| Manage + Protect per endpoint, monthly | |
| Persistent Guard license (one-time, self-hosted) | +$10.00 |
Prices in USD per endpoint. Annual billing is ten months’ price for twelve months of service. Join while founding pricing lasts and your rate is locked in for life on the plan you buy.
See every feature, the comparison table and a fleet cost calculator at combine.metahuman.network →
