Quick Start

Get GuardFoxCopilot running in under 10 minutes — cloud or self-hosted.

Route: /docs/quickstart

Cloud SaaS (Fastest)

Setup

Cloud SaaS Setup

The fastest way to start. No server required.

Visit guardfoxsecurity.com and click Start Free Trial
Create your account — choose your organisation name
Your subdomain is provisioned instantly: portal.guardfoxsecurity.com
Log in with your credentials
Go to Administration → Data Sources to connect your first SIEM connector
Install your first EDR agent on an endpoint (see Agent Installation below)

Your free trial includes 14 days of the Professional tier with full feature access. No credit card required.

Self-Hosted (Docker)

Setup

Self-Hosted Setup

Run GuardFoxCopilot on your own infrastructure with Docker Compose.

Prerequisites

Docker Desktop (Windows/Mac) or Docker Engine (Linux)
4 GB RAM minimum, 8 GB recommended
PostgreSQL 14+ (or use the bundled container)

One-command install (Windows)

# Run as Administrator
Invoke-WebRequest https://guardfoxsecurity.com/install.ps1 | iex

The installer automatically:

Checks for Node.js, Docker, and Git
Installs missing dependencies via winget
Clones the repository
Generates a .env file with secrets
Runs Prisma migrations
Seeds the database
Starts the platform

Manual install (Linux / macOS)

git clone https://github.com/Hack2Report/GuardFoxCopilot
cd GuardFoxCopilot
cp .env.example .env
# Edit .env with your database URL and secrets
docker compose up -d
npx prisma migrate deploy
npx prisma db seed

Access

Open http://localhost:3000 after startup. Default admin credentials are in the .env file you generated.

Install First EDR Agent

Setup

Installing the EDR Agent

Windows (PowerShell — run as Administrator)

# Replace YOUR_API_KEY with the key from Settings → Agent Keys
$env:GuardFox_API_KEY = "YOUR_API_KEY"
$env:GuardFox_SERVER  = "https://portal.guardfoxsecurity.com"
Invoke-WebRequest "$env:GuardFox_SERVER/install-agent.ps1" | iex

Linux (bash)

curl -sSL https://portal.guardfoxsecurity.com/install-agent.sh |   GuardFox_API_KEY=YOUR_API_KEY bash

macOS

curl -sSL https://portal.guardfoxsecurity.com/install-agent-mac.sh |   GuardFox_API_KEY=YOUR_API_KEY bash

The agent starts automatically and appears in Endpoint (EDR) → Agent Portal within 60 seconds.

What the agent does

Sends heartbeat every 30 seconds
Streams process, file, network, and registry events
Runs YARA memory scans on suspicious processes
Monitors PowerShell script block logs
Protects VSS shadow copies from deletion
Supports remote quarantine and forensic collection