Custom Windows Event monitors
Monitor additional Windows Event Log channels and event IDs, extract source addresses and usernames, classify failed or successful authentication, and feed the result into Guard's normal alerting and blocking pipeline.
Windows Server attack protection
Scantide Guard for Windows Server
Monitor failed authentication and hostile web activity, correlate repeated sources, and apply controlled Windows Firewall blocks without turning the server into a heavy endpoint-security platform.
Windows Security Event 4625 failed-logon monitoring
Supported as part of the Guard monitoring, policy or enforcement workflow.
Kerberos 4771 pre-authentication failure monitoring
Supported as part of the Guard monitoring, policy or enforcement workflow.
RDP and RDWeb attack correlation
Supported as part of the Guard monitoring, policy or enforcement workflow.
IIS web request and hostile-probe monitoring
Supported as part of the Guard monitoring, policy or enforcement workflow.
SQL Server 18456 failed-login detection
Supported as part of the Guard monitoring, policy or enforcement workflow.
Exchange SMTP authentication monitoring
Supported as part of the Guard monitoring, policy or enforcement workflow.
Capabilities
What this Guard workflow covers
- Windows Security Event 4625 failed-logon monitoring
- Kerberos 4771 pre-authentication failure monitoring
- RDP and RDWeb attack correlation
- IIS web request and hostile-probe monitoring
- SQL Server 18456 failed-login detection
- Exchange SMTP authentication monitoring
- Temporary and permanent Windows Firewall blocks
- Country, Tor and reputation-assisted policy
- Custom Windows Event and log-file monitors
- Windows certificate-store and certificate-file reconnaissance
- Schannel TLS posture with separate client/server protocol state
Designed around observable server evidence
Scantide Guard does not need to attack, exploit or brute-force a service to decide that repeated hostile activity deserves action. Collectors observe evidence already generated by the server, normalize it into a common event model, then apply explicit thresholds, allowlists, exceptions and enforcement policy.
The result is intended to be understandable by an administrator: which source IP was seen, which collector reported it, which rule or threshold was reached, what action Guard took, and when a temporary block is due to expire.
Standalone when you need it. Centralized when you grow.
A single Guard can protect its own server with local policy and local firewall enforcement. Organizations with multiple systems can add Scantide Guard Datacenter for shared policy, fleet visibility, licensing and coordinated reputation services.
Download
Download Scantide Guard for Windows 0.8.4
There is one Windows installer for Scantide Guard. It provides Guard and Datacenter on supported modern Windows systems and automatically selects the compatible Legacy Guard implementation on Windows Server 2008 R2 SP1.
Windows
One unified Windows installer
SHA-256
ba805e33dcf7eb8f3bdb55b31df5a6c3a307c01a07f73f1149dfe57563410591
New in 0.8.4
Scheduled security statistics email
Guard can send a concise security summary for the previous 24 hours or 7 days, separate from immediate attack alerts. Reports can include attack activity, unique attackers, blocks, countries and collectors/rules, with their own recipient list.
New in 0.8.2
Certificate discovery and local TLS posture
Guard can now inventory local certificate material and make certificate/TLS posture easier to understand without changing the system. Run a Windows certificate-store check, sweep local certificate files or run a full certificate reconnaissance pass. Findings are presented per certificate with expiry, chain, private-key state, likely consumer and replacement-readiness context.
Certificate discovery
Review Windows certificate stores and local PFX/P12/PEM/CER/CRT files, including application-oriented locations such as CrushFTP and common web/proxy certificate paths.
Client and server TLS
TLS posture distinguishes inbound server settings from outbound client settings. Raw Schannel/OpenSSL and configuration evidence remains available for administrators who need the detail.
Datacenter visibility
Managed Guards can report compact certificate and TLS/cryptography posture to Datacenter so fleet-level issues are visible per Guard.
Under development: certificate handling in 0.8.2 is reconnaissance and validation-only. Guard does not automatically replace certificates, export private keys, change trust roots or rebind services.
Frequently asked questions
Does Guard replace Windows Firewall?
No. Guard uses the local Windows firewall as the enforcement layer and adds correlation, policy, evidence and automated block management.
Can it protect RDP?
Yes. Guard can correlate failed Windows/RDP authentication evidence and block hostile source IPs according to configured thresholds and allowlists.
Is a Datacenter server required?
No. Guard can run standalone. Datacenter adds centralized policy, visibility and fleet management.
See Scantide Guard in context
Read the current Guard documentation, deployment notes and product status, then choose the Windows, Linux or Datacenter path that fits your environment.
Supported operating systems
See the current Windows Server, Windows client, Legacy Windows and Linux compatibility overview, including which platforms are tested, targeted or still awaiting explicit validation.
View OS compatibilityWindows Server 2008 R2 through Windows Server 2025
Scantide Guard is intended for Windows Server estates ranging from Windows Server 2008 R2 SP1 through current Windows Server releases. The product family includes Windows Server 2008 R2, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022 and Windows Server 2025. Server 2008 R2 uses the Legacy Guard implementation; later Windows Server versions use the modern Guard implementation.
Beyond the built-in collectors
Built-in monitors are the starting point, not the limit.
RDP, Kerberos, SQL Server, IIS/RDWeb, Exchange SMTP and other bundled collectors are best understood as preinstalled and preconfigured monitors. They give Guard useful coverage immediately, but the deeper capability is the same Guard event-and-policy model applied to your own applications.
Custom log-file monitors
Watch application log files and folders, including rotating/new files, using administrator-defined parsing rules. This lets Guard protect software that does not have a dedicated built-in collector.
Independent policy per monitor
Each monitor can inherit the global Guard policy or use its own alert threshold, block threshold, time window, block duration, immediate-block behavior and notification routing. Application-specific recipients can be added to or replace the normal server recipient list.
Successful-login awareness
Custom monitors can classify successful authentication as well as failures so Guard can learn trusted administration sources and reset or contextualize active failure history where appropriate.
Community and managed monitors
Monitor definitions can be packaged, reviewed and distributed. Datacenter can centrally distribute managed monitors while locally authored monitors remain distinct.
Explainable enforcement
Custom-monitor events use the same Guard model as built-ins: evidence, source IP, username where available, monitor identity, thresholds, alerting and firewall action remain visible and auditable.
In other words: the named protocols on this page are not a closed support list. They are the common services Guard can monitor out of the box. Custom Monitors are how Guard extends the same protection model to line-of-business software, remote-access tools, appliances and other applications that expose usable authentication or security events.
Explore Custom Monitors Browse Monitor Catalogue
Reduce false positives automatically
Blocking an attack is one thing. Knowing when not to block is another.
Guard does more than count failures. Supported built-in collectors and Custom Monitors can also classify successful authentication. That lets Guard learn which source addresses are repeatedly associated with legitimate administration and use that evidence to reduce unnecessary blocking.
Successful-login learning
When a trusted authentication source reports a successful login, Guard can use that evidence to learn or reinforce the source as a known administrative origin instead of treating every future failure from that address as hostile.
Reset-on-success behavior
A successful login can reset or contextualize the active failure counter for the same source where the monitor supports it, helping distinguish mistyped credentials from a sustained brute-force attack.
Works with Custom Monitors
Custom Monitors can classify both failed and successful authentication, so trusted-source learning is not limited to RDP or other built-in collectors. Applications with usable login evidence can participate in the same model.
Explainable trust
Learned trust should remain visible and auditable: administrators can see why a source became trusted and distinguish learned entries from manually configured allow lists.
Safer than blind whitelisting
The goal is not to permanently trust any IP that happens to log in once. Trust decisions are tied to supported authentication evidence and Guard policy so administrators retain control.
Useful across managed estates
Combined with Datacenter, successful-login intelligence can help reduce friction for known management sources while keeping attack blocking and repeat-offender handling active across the fleet.
Smarter protection
Blocking an attack is one thing. Knowing when not to block is another.
Scantide Guard can use successful authentication evidence from supported built-in collectors and Custom Monitors to recognize trusted administration sources, reset or contextualize active failure history where appropriate, and reduce unnecessary blocking without weakening the deterministic protection model.
Learn from successful logins
Trusted authentication evidence can help Guard distinguish legitimate administration from repeated hostile attempts.
Reduce false-positive blocking
Successful authentication can reset or contextualize active failure counters where supported, helping avoid blocking known legitimate sources after simple mistakes.
Not limited to built-in collectors
Custom Monitors can classify both failed and successful authentication, so trusted-source learning can extend to your own applications as well.
Datacenter on legacy Windows
Datacenter also supports Windows Server 2008 R2 SP1. The unified Windows installer covers the Windows Guard family, including modern Guard, Legacy Guard selection, and Datacenter installation without requiring a separate Datacenter package.
Explore Datacenter