Resources for security analysts using Guard, including querying Guard from Slack with the chat bot.

Analyst Resources

Install the Marcus Slack app, connect a channel to a Guard account, and ask Marcus questions about your attack surface from Slack.

Slack – Marcus Chat Integration

How to download agent testing logs for Hannibal findings to review the agent's reasoning and evidence trail.

Agent Testing Logs

What Guard is and how to get started with your first seeds, the onboarding wizard, and your dashboard.

Welcome to Praetorian Guard

An overview of Guard's five modules, from attack surface management to breach and attack simulation, and its attack agents.

What is Praetorian Guard?

How Guard maps and scores risk across external, internal, cloud, application, code, and LLM attack surfaces.

Attack Surfaces

How Guard discovers your web applications and APIs, maps their authentication, and tests them for security vulnerabilities.

Application Attack Surface

How Guard scans your CI/CD pipelines across GitHub, GitLab, Azure DevOps, and Jenkins for supply-chain risks.

CICD Pipeline Surface

How Guard connects to your cloud accounts to inventory resources and find public exposures, secrets, and misconfigurations.

Cloud Attack Surface

How Guard discovers and tests everything your organization exposes to the public internet, starting from your seeds.

External Attack Surface

How Guard assesses your Active Directory and tests internal network services for weak credentials.

Internal Attack Surface

How Guard finds the LLM and AI services in your environment and tests them for prompt injection and related risks.

LLM Attack Surface

Upload an Android APK and let Guard decompile it, analyze its manifest, and file findings alongside the rest of your attack surface.

Mobile Attack Surface

How Guard discovers your repositories and scans them for vulnerabilities, exposed secrets, and pipeline weaknesses.

Source Code Surface

How Guard finds breach-exposed employee email addresses on your domains and flags domains open to email spoofing.

User Attack Surface

What each Guard module covers, from attack surface and vulnerability management to pentesting and red teaming.

Platform Modules

How Guard expands your seeds into discovered assets, suggests new seeds for approval, and tracks each asset's status.

Attack Surface Management (ASM)

How Guard scores each simulated MITRE ATT&CK technique from Prevented to Undetected and rolls them into a posture score.

Breach & Attack Simulation (BAS)

How Guard enriches CVE findings with CVSS, CISA KEV, EPSS, MITRE ATT&CK techniques, and CWE weaknesses.

Cyber Threat Intelligence (CTI)

How Guard runs offensive agents like Julius, Hadrian, Trajan, and Brutus, and has Praetorian operators validate findings.

Penetration Testing & Application Security

The Ludacris-only product module: a counted red-team engagement per year, run by Praetorian — not a customer self-serve Attacks tab.

Red Teaming

How Guard aggregates findings from Nuclei and connected scanners into one risk inventory with a shared lifecycle, origin, and enrichment.

Unified Vulnerability Management

Praetorian's Roman-named capabilities that Guard runs, such as Brutus, Julius, Titus and Trajan, many of them open source, plus Knossos deception environments.

The Caesars

Augustus is an LLM vulnerability scanner that tests AI systems for jailbreaks, prompt injection, MCP server security, and other attack techniques across a broad range of model providers.

Augustus: LLM Vulnerability Scanner

Aurelian is an open-source, multi-cloud security reconnaissance framework that enumerates cloud resources, detects misconfigurations, finds secrets, and identifies privilege escalation paths across AWS, Azure, and GCP.

Aurelian: Multi-Cloud Security Reconnaissance

Brutus is a credential testing capability in the Praetorian Guard Platform supporting 43+ protocols, a cumulative credential corpus for cross-service reuse testing, account enumeration with named results, and seamless pipeline integration.

Brutus: Modern Credential Attack Testing

How to use Constantine's autonomous vulnerability discovery and patching engine, and its code repository security analysis capability — including CVE benchmark coverage, LLM-driven entrypoint discovery, the agentic threat-hunting agent, proof-of-exploitation lifecycle tabs, build caching, repository security review workflow, and scored repository findings via the CLI and MCP server.

Constantine: Locates Fatal Security Bugs in Software & Code Repository Security Analysis

Hadrian is a security testing framework for REST, GraphQL, and gRPC APIs that tests for OWASP API vulnerabilities using role-based authorization testing and YAML-driven templates.

Hadrian: API Security Testing

How Julius, Praetorian's open-source tool, identifies the LLM serving software, such as Ollama or vLLM, behind an endpoint.

Julius: LLM Service Fingerprinting

Nerva is Guard's network fingerprinting engine — identifying services, extracting versions, and correlating CVEs across your attack surface.

Nerva: Service Fingerprinting

How Pius, the open-source tool behind Guard's asset discovery, maps your domains, subdomains, and IP ranges.

Pius: Attack Surface Mapping

Titus is Praetorian Guard's purpose-built secret scanner, providing automated continuous secret discovery, validation, and on-demand credential analysis across your attack surface.

Titus: Secrets Discovery

Trajan scans GitHub Actions, GitLab CI/CD, and Azure DevOps pipelines for supply-chain and CI/CD security risks, surfacing misconfigurations, excessive permissions, and exploitable vulnerabilities — and can now run as a native GitHub Action with verification chains for confirmed findings.

Trajan: CI/CD Pipeline Attacks

Vespasian discovers API endpoints from captured traffic and generates REST, GraphQL, SOAP, and WebSocket specifications, including SPA endpoints recovered via JS static analysis in fully offline capture-once/generate-many workflows.

Vespasian: API Discovery and Specification Generation

Caligula scans software supply chains for known vulnerabilities, malicious packages, compromised AMIs, and IaC image references across 7 ecosystems and 12 manifest formats, integrated natively into Guard.

Caligula: Software Supply Chain Security Scanner

Automated tier-one web application vulnerability discovery powered by the Probus adapter, with API fuzzing findings surfaced in Guard.

Probus Web Application Attack Surface

Knossos procedurally generates realistic decoy cloud environments so attackers waste time in fake infrastructure instead of yours.

Knossos: Deception Environments

Sign up for Guard, set up multi-factor authentication, and manage your user profile.

Getting Started with Praetorian Guard Platform

Ask Marcus about your attack surface, and use metrics, benchmarks, Query Builder, Graph Explorer, and reports.

Insights

How Guard turns your open, validated internet-facing risks into the A–F grade and 0–100 score on the Metrics page.

How Your Internet Perimeter Score and Grade Are Calculated

How to use Marcus, Guard's AI assistant, and what to expect from its performance on large, complex workflows.

Marcus AI Assistant

Overview of the Insights page, including AI Assistant, Metrics, Benchmarks, Query Builder, and Graph Explorer.

Insights → Metrics: track vulnerabilities, assets, and remediation trends across customizable dashboard widgets.

Metrics

Insights → Benchmarks: see your coverage across MITRE ATT&CK, D3FEND, EMB3D, NIST CSF, and FDA Premarket.

Benchmarks

Insights → Query Builder: build, run, and save graph queries across your assets, risks, ports, and cloud resources.

Query Builder

Explore entity relationships from Insights → Graph Explorer.

Graph Explorer

Export your vulnerabilities, assets, seeds, and technologies as CSV or JSON, or generate formatted PDF risk reports.

Reporting and Exports

Ask Aurelius whether scanning seen on your infrastructure came from Guard, checked against Guard's scan records.

Scan Attribution

Ask Marcus about your attack surface from Insights → AI Assistant.

AI Assistant

Add domain, CIDR range, and web application seeds, set up authenticated scanning, and trace how domains were found.

Seeds

How to define, manage, and triage seeds on the Seeds page in the Praetorian Guard Platform.

Add IP addresses and CIDR ranges as discovery seeds from the CIDR Ranges tab and review their ISP and country details.

Add domains as discovery seeds, review their WHOIS registrant and registrar details, and filter them by status, tag, or country.

Domains

Add full application URLs as web application seeds so Guard can test them, then review each app from its seed drawer.

Web Applications

View the full discovery provenance tree for any domain asset to understand exactly how and why it appears in your attack surface.

Asset Discovery Provenance Tree

Add login credentials to a web application seed so Guard scans it signed in, by AI sign-in, existing token, or manual login flow.

Authenticated Scanning for Web Applications

Review screenshots Guard captures of discovered web applications in Contact Sheet or Triage Inbox view on Assets → Screenshots.

Assets

Assets are the foundation of your attack surface in Guard, representing everything externally discoverable that belongs to your organization.

Triage captured web application screenshots from Assets → Screenshots.

Screenshots

Technologies

Browse detected products and versions on the Technologies page.

Triage and resolve findings, browse the Nuclei signature catalog, and follow emergent-threat CVE alerts.

Vulnerabilities

How to triage, track, and resolve security vulnerabilities Guard discovers across your attack surface.

How to browse, filter, preview, and launch Nuclei templates from the Signatures catalog on the Vulnerabilities page.

Signatures Catalog

How Guard alerts you when a new high-risk CVE is scanned for, found in your environment, and proven exploitable.

Emergent-Threat CVE Automation

Find exploited vulnerabilities with the CISA KEV and EPSS filters, and read exploitation details in the vulnerability drawer.

Exploits

Browse exploit intelligence on CVEs with KEV, EPSS, and CVSS data, and view connected threat intelligence feeds.

Threats

Search a CVE to see its EPSS and CVSS scores, CISA KEV status, exploit timeline, threat actors, and ATT&CK techniques.

Threat Intelligence

Run the Critical Advisories saved queries in Query Builder to find CVE-related vulnerabilities, and turn on advisory emails.

Advisories

View data from your connected threat intelligence platforms on Threats → Threat Intelligence.

Intel Sources

Attack path diagrams and narratives, agent testing logs, and the tools Praetorian operators use during engagements.

Attacks

Attach a custom tag when you launch a hunt so every finding it files can be filtered, tracked, and reported on separately.

Per-Hunt Custom Finding Tags

How to explore, navigate, and export Attack Path diagrams and narratives in Praetorian Guard.

Attack Paths

Attacks → C2 Bridge: connect a bridge to view Sliver, Mythic, and other C2 sessions, beacons, and hosts in one place.

C2 Bridge

Browse, filter, and run Guard capabilities from the Attacks → Capabilities tab.

Capabilities

Check out and manage parked domains used for phishing and red-team sending from Attacks → Domain Parking.

Domain Parking

Attacks → Juicy Fruit: review the open-source repository vulnerabilities Guard discovered from public OSINT sources.

Juicy Fruit

Attacks → Payload Generator: build a signed MSI installer from your shellcode for authorized assessments.

Payload Generator

Build and manage phishing campaigns from Attacks → Phishing.

Phishing

View and manage team-server instances from Attacks → Team Servers.

Team Servers

Enumerate people and probe account-existence oracles from Attacks → Phishing → Target OSINT.

Target OSINT

How Guard measures detection coverage with the Security Posture Score, ATT&CK gap analysis, and Knossos decoys.

Detections

Create and monitor Knossos deception environments from Detections → Decoys.

Decoys

How new detection templates are automatically tested against a live affected target before they can merge and ship.

Nuclei Template Validation Pipeline

How to use the Detections page in Guard, including BAS results, gap analysis, and Automatic Findings Validation settings.

Find undefended ATT&CK techniques from Detections → Gap Analysis.

Gap Analysis

Create and watch detection sessions from Detections → Sessions.

Sessions

Read Security Posture Score and coverage from Detections → Overview.

Overview

Connect third-party security tools, cloud providers, and IT services to Guard.

Integrations

Connect SecurityScorecard or Black Kite to import security ratings, risk findings, and the domains they cover into Guard.

Security Ratings

How Guard's integration categories are organized and how to open an integration card to connect a tool.

Integrations Overview

Scan pages and blog posts in your Confluence Cloud spaces, including prior versions, for exposed secrets.

Knowledge Bases

Import application security findings from Aikido into Guard as risks on your code repositories and domains.

Application Security Posture Management

Import web application and API scan findings from Burp Enterprise, Invicti, and Snyk DAST into Guard as risks.

Application Security Testing (AST)

Connect Guard to AttackIQ, Cymulate, or SafeBreach with your account's API credentials.

Breach Attack Simulation

Import HackerOne bug bounty reports into Guard as risks and program scope as seeds.

Bug Bounty

Discover assets in your AWS, Google Cloud Platform, Microsoft Azure, and DigitalOcean environments through read-only cloud access.

Cloud

Import cloud security alerts and vulnerabilities from Wiz, Orca Security, and Cortex Cloud into Guard as risks on your cloud assets.

Cloud Security Posture Management

Import domains from your Fastly CDN and Next-Gen WAF services into Guard as assets.

Content Delivery Solutions

Import assets and exposures from Axonius, Censys ASM, Cortex Xpanse, and JupiterOne, or map Active Directory with SharpHound.

Cyber Asset Attack Surface Management

Import devices as assets and their findings as risks from CrowdStrike, Defender, SentinelOne, and ExtraHop.

Endpoint Detection Response

Allowlist Guard scanning in AWS WAF, Cloudflare, and Vercel, or import ThreatX protected sites as assets.

Firewalls

How Guard reads SSO-configured applications from Okta and Microsoft Entra ID and imports their login URLs as web application assets.

Identity and Access Management

Create tickets and work items from Guard vulnerabilities in ITSM tools such as Jira, Linear, Azure DevOps, and Freshdesk.

IT Service Management (ITSM)

Connect Jamf Pro to import the IP addresses of your managed Macs and mobile devices into Guard as assets.