Internet-facing RDP services are continuously probed. Guard watches trusted Windows authentication evidence, correlates repeated failures and can block the source IP locally before it continues hammering the server.
Supported as part of the Guard monitoring, policy or enforcement workflow.
Supported as part of the Guard monitoring, policy or enforcement workflow.
Supported as part of the Guard monitoring, policy or enforcement workflow.
Supported as part of the Guard monitoring, policy or enforcement workflow.
Supported as part of the Guard monitoring, policy or enforcement workflow.
Supported as part of the Guard monitoring, policy or enforcement workflow.
Scantide Guard does not need to attack, exploit or brute-force a service to decide that repeated hostile activity deserves action. Collectors observe evidence already generated by the server, normalize it into a common event model, then apply explicit thresholds, allowlists, exceptions and enforcement policy.
The result is intended to be understandable by an administrator: which source IP was seen, which collector reported it, which rule or threshold was reached, what action Guard took, and when a temporary block is due to expire.
A single Guard can protect its own server with local policy and local firewall enforcement. Organizations with multiple systems can add Scantide Guard Datacenter for shared policy, fleet visibility, licensing and coordinated reputation services.
Windows Security Event ID 4625 is a common failed-logon source. Guard also supports other trusted authentication evidence depending on the configured collector.
Administrators should configure allowlists and trusted networks before aggressive blocking. Guard policy is intended to preserve explicit allowlist precedence.
No. Guard observes local server evidence. It does not need to probe or authenticate to RDP itself.
Read the current Guard documentation, deployment notes and product status, then choose the Windows, Linux or Datacenter path that fits your environment.
Guard does more than count failures. Supported built-in collectors and Custom Monitors can also classify successful authentication. That lets Guard learn which source addresses are repeatedly associated with legitimate administration and use that evidence to reduce unnecessary blocking.
When a trusted authentication source reports a successful login, Guard can use that evidence to learn or reinforce the source as a known administrative origin instead of treating every future failure from that address as hostile.
A successful login can reset or contextualize the active failure counter for the same source where the monitor supports it, helping distinguish mistyped credentials from a sustained brute-force attack.
Custom Monitors can classify both failed and successful authentication, so trusted-source learning is not limited to RDP or other built-in collectors. Applications with usable login evidence can participate in the same model.
Learned trust should remain visible and auditable: administrators can see why a source became trusted and distinguish learned entries from manually configured allow lists.
The goal is not to permanently trust any IP that happens to log in once. Trust decisions are tied to supported authentication evidence and Guard policy so administrators retain control.
Combined with Datacenter, successful-login intelligence can help reduce friction for known management sources while keeping attack blocking and repeat-offender handling active across the fleet.
Scantide Guard can use successful authentication evidence from supported built-in collectors and Custom Monitors to recognize trusted administration sources, reset or contextualize active failure history where appropriate, and reduce unnecessary blocking without weakening the deterministic protection model.
Trusted authentication evidence can help Guard distinguish legitimate administration from repeated hostile attempts.
Successful authentication can reset or contextualize active failure counters where supported, helping avoid blocking known legitimate sources after simple mistakes.
Custom Monitors can classify both failed and successful authentication, so trusted-source learning can extend to your own applications as well.