👋 Welcome to GuardiaGraph
GuardiaGraph maps your attack surface — assets, identities, and vulnerabilities — into a live graph of the paths an adversary could take to reach your Crown Jewels. This guided setup takes ~5 minutes and configures everything we need to start scoring risk.
🛠️ What we'll set up together
🔁 How the engine turns your data into answers
Where will I see results? After onboarding you'll get a live Dashboard (Crown Jewel exposure, top-risk endpoints, trends), a Risk Scores page, an interactive Attack Graph with the highest-probability adversary paths, and Alerts ranked by impact. Every page explains why something is risky — you'll never see a number without an explanation.
🏢 Tell us about your company
This creates your tenant — a fully isolated workspace. Your company's data, scores, and configuration can never be seen by other GuardiaGraph customers.
Why it matters: Multi-tenancy means row-level isolation in PostgreSQL, separate Neo4j graph namespaces, prefixed Kafka topics, and AES-256-GCM field encryption with a per-tenant key. You get the whole platform, but only your slice of it.
Company details
👤 Create your admin account
This is the account you'll use to sign in. As Admin you'll have full control of your tenant's configuration, assets, and integrations.
Why it matters: GuardiaGraph uses role-based access control (RBAC). Admin is the highest role — it can configure integrations, run simulations, trigger containment, and invite teammates later from the dashboard.
Account details
🖥️ Register your assets
Add the endpoints that matter: servers, workstations, cloud VMs, containers, network devices. For each asset you choose to Accept ✓ (include in the risk graph) or Exclude ✗ (keep it out — e.g. lab / test systems).
What "accept" means: Accepted assets become nodes in your attack graph and receive risk scores. Excluded assets are stored but never scored — perfect for test environments, shadow IT you don't want analyzed yet, or assets you plan to decommission. Mark anything critical as a Crown Jewel (🔮) so the engine focuses on protecting it.
➕ Add an asset
🔌 Data sources — what do we accept?
GuardiaGraph can connect to your existing security tools. For each source you choose to Accept ✓ (we pull data from it) or Unaccept ✗ (we ignore it). Unaccepted sources are not contacted and no data is stored from them.
What this controls: Every scanner category feeds a different part of the model — vulnerability scanners feed CVEs & CVSS/EPSS, EDR feeds endpoint telemetry, IAM / Identity feeds user accounts & MFA posture, CSPM feeds cloud misconfigurations, Threat Intel feeds CISA KEV & exploit probability. If you don't use a vendor, simply unaccept it — you can change any decision later from Settings → Integrations.
📡 Ingest options
🎉 Your workspace is ready!
Here's everything that was configured, and a plain-English guide to how GuardiaGraph will show you results.
🆔 Your identifiers
🖥️ Assets registered (0)
🔌 Data source decisions
⚡ Make your dashboard live right now
Skip the wait for your first sync — load a realistic sample environment (12 endpoints, 16 CVEs, 18 network pivots, crown jewels, alerts) and run the full scoring engine immediately. Your Risk Scores, Heatmap, Attack Graph, Alerts and Executive Dashboard will be fully populated the moment you click Open.
📖 Understand your results — explained
The engine connects every accepted asset, identity, and vulnerability into a graph. It then computes the most probable adversary paths toward your Crown Jewels using probabilistic scoring (identity surface × vulnerability surface × network adjacency × crown-jewel proximity).
- Nodes = assets, identities, vulnerabilities.
- Edges = reachable pivots, each with a probability of being used.
- Highlighted paths = the highest-probability routes — see them in the Attack Graph page.
Every node gets a composite risk score combining node risk (CVEs, exploitability), choke score (how many paths converge here), local exposure, and proximity to Crown Jewels.
- 85–100 Critical — likely on an active attack path; act now.
- 70–84 High — high exposure, prioritize this week.
- 40–69 Medium — monitor and schedule remediation.
- 0–39 Low — healthy posture.
Crown Jewels are your most critical assets (finance DBs, domain controllers, IP vaults). We compute a Crown Jewel Exposure Score — the probability-weighted likelihood that an attacker reaches a Crown Jewel from any starting point.
- Mark assets as Crown Jewels by setting sensitivity to Critical (or the 🔮 toggle while adding).
- The exposure score trend appears on the Executive Dashboard — dropping it is the goal of every remediation.
Raw events are rationalized: each is scored by computed criticality × crown-jewel impact. Incomplete data is never silently suppressed — it's flagged Needs Review. Expect ~85% noise reduction versus raw SIEM alerts.
SOAR Playbooks auto-generate ranked containment runbooks (patch, isolate, revoke, segment) for compromised assets, exportable to XSOAR, Splunk SOAR, or Sentinel. Simulation lets you test "what if we patch X and revoke Y?" and see the risk reduction before deploying.
If you use your own pipelines, push normalized events directly:
- POST /api/v1/ingest/logs — JSON events
- POST /api/v1/ingest/cef — CEF syslog
- POST /api/v1/ingest/syslog — raw syslog with CVE tokens
- GET /api/v1/discovery/setup-script/linux|windows — agent scripts for remote discovery
- Now: accepted data sources sync on the schedule you chose (default hourly).
- +1 sync: assets, CVEs, identities flow in → the engine builds your first attack graph.
- After build: risk scores, heatmap, choke points, and dashboard metrics appear.
- Ongoing: daily scoring, real-time updates via WebSocket, and Kafka-streamed change events keep everything current.