KONGUARD

The Trust Protocol for Windows Systems

KONGUARD isn't a monitoring tool. It's an immutable witness that answers one question with forensic-grade clarity:

"What actually happened to this machine?"

In a world where logs are manipulated, metrics are hidden in cloud black boxes, and systems lie—KONGUARD is the offline, explainable, read-only truth layer you can trust.

The Problem:

• Ransomware strikes → "When did the disk writes spike?"
• Server degrades → "Show me 90 days of hardware health"
• Audit demands proof → "Evidence this system wasn't compromised"

Current Solutions Fail:

• Cloud-dependent (vendor-controlled)
• Black-box algorithms (unexplainable)
• Mutable logs (can be tampered)
• Reactive alerts (after disaster)

KONGUARD Delivers:

• Offline-First: Works in airgapped networks
• Explainable: Every metric has plain-language context
• Immutable: Cryptographically verifiable snapshots
• Before/After Intelligence: Detects changes over time
• Zero Dependencies: Pure PowerShell, no installations

# Download
git clone https://github.com/konguard/konguard.git
cd konguard

# Run first scan
.\konguard.ps1

That's it. No dependencies. No cloud signup. No configuration.

KONGUARD v0.1.0 - System Snapshot
Generated: 2025-01-14 14:32:11 UTC
═══════════════════════════════════════════════════════════════

[✓] HARDWARE
    CPU:  Intel Core i7-9700K @ 3.60GHz (8 cores)
          Current: 23% | Temperature: 48°C | Status: Normal
    
    RAM:  32 GB DDR4
          Available: 18.4 GB (57%) | Status: Healthy
    
    Disk: Samsung SSD 970 EVO Plus 1TB
          Health: PASSED | Temperature: 36°C | Hours: 2,847
          Bad Sectors: 0 | Wear Level: 2%

[✓] SECURITY
    Antivirus:     Windows Defender (Active, Updated)
    Firewall:      Enabled (Domain, Private, Public)
    Windows Update: 0 pending updates
    User Accounts:  3 total | 0 new accounts (last 7 days)

[✓] SNAPSHOT SAVED
    Location: C:\KONGUARD\snapshots\snapshot_20250114_143211.json
    Size:     47 KB
    
Next Steps:
  • Run again tomorrow to enable change detection
  • View timeline: konguard.ps1 --report
  • Generate HTML report: konguard.ps1 --export-html

Every scan creates a timestamped, tamper-evident record:

{
  "timestamp": "2025-01-14T14:32:11Z",
  "konguard_version": "0.1.0",
  "hardware": { "cpu": {...}, "ram": {...}, "disk": {...} },
  "security": { "antivirus": {...}, "firewall": {...} },
  "signature": "sha256:a3f5..."
}

konguard.ps1 --compare-yesterday

⚠️ CHANGES DETECTED (Last 24 hours)
─────────────────────────────────────────
  • Disk writes: ↑ 340% (Normal: 45 MB/hr → Current: 198 MB/hr)
  • New process: chrome.exe (started: 09:14:22)
  • Windows Update: 3 updates installed

konguard.ps1 --timeline --days=30

Generates interactive HTML showing 30-day trends for every metric.

konguard.ps1 --export-html

Self-contained report that works without internet. Perfect for compliance audits.

# Run a scan (default)
.\konguard.ps1

# Compare with previous scan
.\konguard.ps1 --compare

# Generate HTML report
.\konguard.ps1 --export-html

# Show help
.\konguard.ps1 --help

# Paranoid mode (zero external dependencies)
.\konguard.ps1 --mode=paranoid

# Scan with cryptographic signature
.\konguard.ps1 --sign --key=company.pem

# Compare against baseline (30 days ago)
.\konguard.ps1 --compare-baseline --days=30

# Export to JSON for integration
.\konguard.ps1 --export-json --output=audit_report.json

• OS: Windows 10/11, Windows Server 2016+
• PowerShell: 5.1 or later
• Privileges: Administrator (for hardware access)
• Storage: 1 MB per snapshot (~30 MB/month with daily scans)
• Dependencies: None (uses native Windows APIs)

• MIT License
• Project structure
• Core snapshot engine
• First working prototype

• Hardware intelligence (CPU, RAM, Disk, GPU)
• Software visibility (OS, apps, processes)
• Security posture (AV, firewall, updates)

• Baseline learning (detect "normal")
• Change detection algorithms
• Forensic timeline visualization

• Explainable scoring algorithm
• Risk prioritization
• Remediation guidance

• Fleet management
• Compliance report templates
• API for integrations

KONGUARD is built on trust, which means transparent development:

1. Read CONTRIBUTING.md
2. Discuss features in GitHub Issues
3. Submit PRs with tests and documentation

We value:

• Explainability over complexity
• Offline-first over cloud-first
• Security over convenience
• Community over corporate control

"Check all lab machines for hardware issues before semester starts"

konguard.ps1 --fleet scan 192.168.1.0/24

"Detect ransomware patterns across all endpoints"

konguard.ps1 --hunt --pattern=ransomware

"Generate HIPAA audit report for all servers"

konguard.ps1 --report --template=HIPAA --date-range=2024-Q4

"Monitor 500 client machines without cloud costs"

konguard.ps1 --client ACME-Corp --schedule daily

Q: Why PowerShell instead of Python/Go/Rust?
A: Zero-dependency deployment. Every Windows machine has PowerShell. No installers, no runtimes, no friction.

Q: Why not use cloud monitoring?
A: Cloud tools have access to your data 24/7. KONGUARD data never leaves your network unless YOU choose to export it.

Q: Is this just for enterprises?
A: No. Homelab enthusiasts, students, and small businesses benefit equally. Free forever.

Q: How is this different from Task Manager / Resource Monitor?
A: Those show "right now." KONGUARD shows "what changed over 30/60/90 days" with forensic-quality evidence.

Q: Can I trust MIT-licensed software?
A: That's exactly WHY we chose MIT. You can audit every line of code. No secrets, no backdoors.

konguard/
├── konguard.ps1           # Entry point (single-file for simplicity)
├── LICENSE                # MIT License
├── README.md              # This file
├── modules/               # Core functionality (Phase 1+)
│   ├── Hardware.psm1
│   ├── Software.psm1
│   ├── Security.psm1
│   └── Baseline.psm1
├── snapshots/             # Local storage (git-ignored)
│   ├── snapshot_20250114.json
│   └── snapshot_20250115.json
├── reports/               # Generated HTML/PDF reports
└── docs/
    ├── ARCHITECTURE.md
    ├── USAGE.md
    └── CONTRIBUTING.md

• Documentation: docs/
• Issues: GitHub Issues
• Discussions: GitHub Discussions
• Security: SECURITY.md

KONGUARD is MIT-licensed. Use it anywhere, for any purpose, with zero restrictions.

See LICENSE for full details.

Built by people who believe system monitoring should be:

• Trustworthy (open source, auditable)
• Accessible (free, no barriers)
• Explainable (every number has context)
• Offline-capable (works in airgapped environments)

If you share these values, welcome to KONGUARD.

Status: Alpha | Version: 0.1.0 | Last Updated: 2025-01-14