Guard Settings

Configuration reference for all 10 BlueSentinel security guards.

USB Guard

Detects, blocks, and ejects unauthorized USB storage devices.

Configuration:

  • enabled — Enable/disable the guard
  • mode — block (prevent access) or alert (log only)
  • auto_eject — Automatically eject unauthorized devices
  • whitelist — List of allowed USB serial numbers

Default blocked devices: All USB mass storage devices (flash drives, external HDDs, SD card readers, phone USB tethering).

Network Guard

Controls network access by blocking unauthorized ports and protocols.

Configuration:

  • enabled — Enable/disable the guard
  • mode — block or alert
  • blocked_ports — List of TCP/UDP ports to block
  • allowed_ips — IP addresses exempt from port blocking

Default blocked ports: 21 (FTP), 22 (SSH/SCP), 23 (Telnet), 69 (TFTP), 873 (rsync), 2049 (NFS), 3389 (RDP), 5900 (VNC).

Browser Guard

Monitors and blocks browser-based data exfiltration via an HTTPS proxy.

Configuration:

  • enabled — Enable/disable the guard
  • mode — block or alert
  • proxy_port — Local proxy port (default: 8889)
  • blocked_domains — Domain blacklist
  • max_post_size — Maximum allowed POST body size in bytes (default: 50 KB)
  • blocked_extensions — File extensions blocked from upload (30+ defaults)

How it works: The agent runs a local MITM proxy on port 8889 and sets the system proxy to route browser traffic through it. The proxy inspects requests and blocks file uploads, large POST bodies, and requests to blocked domains.

Process Guard

Detects and terminates unauthorized applications.

Configuration:

  • enabled — Enable/disable the guard
  • mode — block (kill process) or alert (log only)
  • blocked_processes — List of process names to block

Default blocked processes (25+): Cloud sync clients (Dropbox, Google Drive, OneDrive), file transfer tools (FileZilla, WinSCP, Cyberduck), remote access (TeamViewer, AnyDesk, RustDesk), messaging (Telegram, Signal, Discord), torrent clients (qBittorrent, uTorrent, Transmission), VPN clients.

Clipboard Guard

Monitors clipboard for sensitive data patterns.

Configuration:

  • enabled — Enable/disable the guard
  • mode — block (clear clipboard) or alert (log only)
  • max_chars — Maximum clipboard content length allowed (default: 300)
  • code_patterns — Regex patterns to detect source code
  • sensitive_patterns — Regex patterns for credentials, API keys, etc.

Screenshot Guard

Blocks screen capture tools and PrintScreen functionality.

Configuration:

  • enabled — Enable/disable the guard
  • mode — block or alert
  • blocked_tools — List of capture/recording tools to block

Blocked by default: Snipping Tool, Snip & Sketch, PrintScreen, OBS Studio, Camtasia, ShareX, Greenshot, LightShot, and other third-party capture tools.

File Watcher

Monitors file system for suspicious operations.

Configuration:

  • enabled — Enable/disable the guard
  • mode — alert (default, logging only)
  • watch_directories — Directories to monitor
  • file_size_threshold — Alert on files larger than this size
  • blocked_extensions — File extensions to flag
  • ignore_patterns — Patterns to exclude from monitoring

How it works: Uses the watchdog library to receive real-time file system events. Alerts on bulk copy operations, large file creation, archive/zip creation, and sensitive directory access.

AirDrop / Bluetooth Guard

Prevents wireless file sharing.

Configuration:

  • enabled — Enable/disable the guard
  • mode — block or alert
  • disable_airdrop — Completely disable AirDrop (macOS)
  • disable_bluetooth_sharing — Block Bluetooth file transfer

Print Guard

Controls document printing activity.

Configuration:

  • enabled — Enable/disable the guard
  • mode — block or alert
  • allowed_printers — List of allowed printer names
  • log_all_prints — Log all print activity with metadata

Encryption Guard

Enforces disk encryption on endpoints.

Configuration:

  • enabled — Enable/disable the guard
  • mode — enforce (auto-enable encryption) or alert (report status only)
  • algorithm — Encryption algorithm (default: AES-256)
  • escrow_recovery_key — Send recovery key to central server

How it works:

  • Windows: Manages BitLocker. Auto-enables if not already active.
  • macOS: Manages FileVault. Auto-enables if not already active.
  • Recovery keys are encrypted and stored on YOUR server, not Microsoft or Apple.