OneGuard Defense Suite by AmonSul

Cyber defense built on the front line. Runs where the cloud can't reach.

One self-hosted suite that detects the attack, contains the device and cuts access in a single loop. Designed with Ukrainian defense units, deployable fully on-premises and in closed networks.

Request a briefing See the tech stack

Hosting

100% self-hosted

Networks

Air-gap ready

Detection content

Tuned on real Russian TTPs

Core

Open, auditable code

Not three tools. One response chain.

Most stacks stop at the alert. OneGuard connects detection to action: a threat seen by the SOC changes what the device can do and what the user can reach — automatically.

Step 1 · Watch

Detect

SIEM correlation and endpoint telemetry flag the compromise.
Step 2 · Watch

Investigate

Live forensic collection across every host in minutes.
Step 3 · Endpoint

Contain

The device is isolated, locked or killed remotely.
Step 4 · Access

Revoke

Sessions and access rights are cut across every protected system.

Three modules. Deploy one, or the full suite.

OneGuard Watch

Security operations center

A security operations center you can run inside your own perimeter — as a managed service or a turnkey install.

Log collection, correlation and alerting
Threat hunting and live forensics at fleet scale
Detection rules written from frontline incidents
File integrity, vulnerability and config monitoring

OneGuard Endpoint

Device management and kill-switch

Full control of every laptop in the field — without handing your device data to a foreign cloud.

Real-time inventory and posture checks
Military hardening baselines out of the box
Remote lock and kill-switch for lost or captured devices
Device health feeds directly into access decisions

OneGuard Access

Zero Trust access and single sign-on

Replace the VPN with per-user, per-application access that re-checks trust on every request.

Single sign-on with OIDC identity providers
Policy decisions: allow, deny or step-up
Browser-based SSH and RDP — no client on field laptops
Access revoked automatically on a SOC alert

A captured laptop should be a brick, not an intelligence source.

Standard device management was built for lost phones in offices. OneGuard Endpoint is built for a laptop left at a position under fire. One command, and the device stops being a way in.

01 TriggerOperator command, missed check-in or SOC detection.
02 LockThe device is locked and cut from the network.
03 DestroyEncryption keys and sensitive data are wiped.
04 RevokeEvery credential and session tied to the device is cancelled.

Open-source core. Proprietary combat layer.

The foundation is proven, auditable open-source software — no black boxes, no vendor lock-in, no hidden cloud dependency. What makes it a defense product is the layer we build on top.

Layer	Capability	Role in OneGuard	Module
Detection	Host agents and correlation engine	Log analysis, correlation rules, alerting	Watch
Forensics	Live response engine	Artifact collection and threat hunting	Watch
Storage and search	Event index and dashboards	Event indexing and analyst views	Watch
Device management	Endpoint management engine	Inventory, posture queries, policy enforcement	Endpoint
Identity	OIDC single sign-on gateway	Authentication and policy enforcement point	Access
Remote access	Clientless session broker	SSH and RDP in the browser	Access
Network	Encrypted overlay network	Secure transport for non-web protocols	Access
OneGuard core	Proprietary	Kill-switch agent, SOC-to-access orchestration, frontline detection content, unified console, air-gapped installer	All

Two ways to deploy.

Managed

We run the SOC for you, 24/7. Your data stays in your infrastructure; our analysts work it.

For defense industry, state enterprises and critical infrastructure

Sovereign install

The full suite installed in your closed network, with operator training and ongoing detection-content updates.

For armed forces, allied governments and classified networks

Built by people who defend real networks under fire.

OneGuard is developed by AmonSul, a Kyiv-based MSSP/MDR provider working alongside Ukrainian defense units since the full-scale invasion. Every module started as an operational need, not a market report.

Our team brings 15+ years in malware analysis, reverse engineering and incident response, and co-founded DC8044 — Ukraine's largest cybersecurity practitioner community.

Request a closed-door briefing.

Tell us about your environment. We'll walk you through the architecture, a live demo and the deployment path that fits your network.

We reply within two business days. Do not send classified or operational details through this form.