> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abusix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Learn about the core concepts, features and data pipeline of Guardian Ops

export const GopsPipeline = () => {
  return <div className="pipeline-container">
      <div className="pipeline-flow">
        {}

        <div className="stage stage-wide">
          <div className="stage-header">
            <h3 className="stage-title">abuse@mailbox</h3>
          </div>

          <div className="stage-content">
            <p className="stage-description">
              Forward your abuse reports to our system using three methods:
            </p>
            <div style={{
    display: "flex",
    gap: "15px",
    justifyContent: "center",
    marginTop: "20px"
  }}>
              <div className="playbook-item" style={{
    flex: "1",
    maxWidth: "180px"
  }}>
                <div className="playbook-text">
                  <div className="playbook-title">E-Mail Forwarding</div>
                  <div className="playbook-subtitle">
                    Forward e-mails using our SMTP datachannels
                  </div>
                </div>
              </div>

              <div className="playbook-item" style={{
    flex: "1",
    maxWidth: "180px"
  }}>
                <div className="playbook-text">
                  <div className="playbook-title">XARF</div>
                  <div className="playbook-subtitle">
                    Use the XARF standard for structurized and machine-readable
                    reporting
                  </div>
                </div>
              </div>

              <div className="playbook-item" style={{
    flex: "1",
    maxWidth: "180px"
  }}>
                <div className="playbook-text">
                  <div className="playbook-title">Global Reporting</div>
                  <div className="playbook-subtitle">
                    Receive abuse reports from Abusix reporting and our other
                    customers
                  </div>
                </div>
              </div>
            </div>

            <div className="link-hint" style={{
    marginTop: "15px"
  }}>
              🔗{" "}
              <a href="https://app.abusix.com/guardian/ops/getting-started" target="_blank">
                Start your trial here to access your individual forwarding address
              </a>
            </div>
          </div>
        </div>

        {}

        <div className="arrow">
          <span className="arrow-label">Reports</span>
        </div>

        {}

        <div className="stage">
          <div className="stage-header">
            <h3 className="stage-title">Report Parsing Engine</h3>
          </div>

          <div className="stage-content">
            <p className="stage-description">
              Parses reports and generates events. Reports usually contain one
              event but we also handle bulk reports with thousands of abuse
              events.
            </p>
          </div>
        </div>

        {}

        <div className="arrow">
          <span className="arrow-label">Events</span>
        </div>

        {}

        <div className="stage">
          <div className="stage-header">
            <h3 className="stage-title">
              Orchestration and Aggregation: Inbound Processing
            </h3>
          </div>

          <div className="processing-content">
            <div className="processing-row">
              <div className="playbook-item">
                <div className="playbook-icon">👤</div>

                <div className="playbook-text">
                  <div className="playbook-title">Customer Resolver</div>
                  <div className="playbook-subtitle">
                    Identify customers using event data (IP, Port, Domain, Date
                    etc.)
                  </div>
                  <div className="learn-more-link">
                    <a href="/docs/guardian-ops/customer-resolution" target="_blank">
                      Learn more...
                    </a>
                  </div>
                </div>
              </div>

              <div className="playbook-item">
                <div className="playbook-icon">🔍</div>

                <div className="playbook-text">
                  <div className="playbook-title">Filtering</div>
                  <div className="playbook-subtitle">
                    Reduce your mailbox volume to relevant reports
                  </div>
                </div>
              </div>
            </div>

            <div className="processing-arrows">
              <div className="processing-arrow" />

              <div className="processing-arrow" />
            </div>

            <div className="playbook-item" style={{
    maxWidth: "360px",
    width: "100%",
    margin: "0 auto"
  }}>
              <div className="playbook-icon">📦</div>

              <div className="playbook-text">
                <div className="playbook-title">Case Groups</div>
                <div className="playbook-subtitle">
                  Aggregate abuse events into groups following customizable
                  rulesets
                </div>
              </div>
            </div>

            <div className="learn-more-link" style={{
    textAlign: "center",
    marginTop: "15px"
  }}>
              <a href="/docs/guardian-ops/inbound-processing" target="_blank">
                Learn more about Inbound Processing...
              </a>
            </div>
          </div>
        </div>

        {}

        <div className="arrow">
          <span className="arrow-label">create</span>
        </div>

        {}

        <div style={{
    display: "flex",
    gap: "20px",
    width: "100%"
  }}>
          {}

          <div className="stage" style={{
    flex: "1"
  }}>
            <div className="stage-header">
              <h3 className="stage-title">📋 Cases</h3>
            </div>

            <div className="stage-content">
              <p className="stage-description">
                Aggregated abuse events grouped by rules into case groups
              </p>
            </div>
            <div className="requirements-section">
              <b>Requires:</b> Customer Resolver, Case Groups
            </div>
          </div>

          {}

          <div className="stage" style={{
    flex: "1"
  }}>
            <div className="stage-header">
              <h3 className="stage-title">👥 Customers</h3>
            </div>

            <div className="stage-content">
              <p className="stage-description">
                Customer-centric view of all related abuse reports
              </p>
            </div>
            <div className="requirements-section">
              <b>Requires:</b> Customer Resolver
            </div>
          </div>
        </div>

        {}

        <div className="arrow">
          <span className="arrow-label">Cases</span>
        </div>

        {}

        <div className="stage">
          <div className="stage-header">
            <h3 className="stage-title">Automation: Playbooks</h3>
          </div>
          <div className="stage-content">
            <p className="stage-description">
              Every Case Group can have a playbook attached. Each case assigned to that group then runs through that playbook.
            </p>
          </div>

          <div className="playbook-grid">
           
            <div className="playbook-item">
              <div className="playbook-icon">⚡</div>
              <div className="playbook-text">
                <div className="playbook-title">API Calls</div>
                <div className="playbook-subtitle">
                  Integrate with your API seamlessly and trigger your internal
                  workflows.
                </div>
              </div>
            </div>



            <div className="playbook-item coming-soon">
              <div className="coming-soon-label">Coming Soon</div>

              <div className="playbook-icon">✉</div>
              <div className="playbook-text">
                <div className="playbook-title">Email Templates</div>
                <div className="playbook-subtitle">
                  Use our E-Mail templating to send notifications and take-down
                  notices.
                </div>
              </div>
            </div>

            <div className="playbook-item">
              <div className="playbook-icon">⏳</div>
              <div className="playbook-text">
                <div className="playbook-title">Delayed Actions</div>
                <div className="playbook-subtitle">
                  Schedule actions to be executed after a specific time
                  interval.
                </div>
              </div>
            </div>

            <div className="playbook-item coming-soon">
              <div className="playbook-icon">⚡</div>
              <div className="coming-soon-label">Coming Soon</div>
              <div className="playbook-text">
                <div className="playbook-title">Triggers</div>
                <div className="playbook-subtitle">
                  Progress your cases by calls from within your systems when a
                  process is ready for the next steps.
                </div>
              </div>
            </div>

            <div className="playbook-item">
              <div className="playbook-icon">👤</div>

              <div className="playbook-text">
                <div className="playbook-title">Manual Tasks</div>
                <div className="playbook-subtitle">
                  Interventions that require manual input
                </div>
              </div>
            </div>

            <div className="playbook-item coming-soon">
              <div className="coming-soon-label">Coming Soon</div>
              <div className="playbook-icon">🔗</div>
              <div className="playbook-text">
                <div className="playbook-title">Repshare</div>
                <div className="playbook-subtitle">Share evidence with your customers.</div>
              </div>
            </div>
          </div>

          <div className="requirements-section">
            <b>Requires:</b> Customer Resolver, Case Group, Playbook
          </div>
        </div>

        {}

        <div className="arrow" />

        {}

        <div className="stage">
          <div className="stage-header">
            <h3 className="stage-title">Refinement and manual interventions</h3>
          </div>

          <div className="stage-content">
            <p className="stage-description">
              In the end you will handle the remaining reports that are not
              covered by automation and require manual intervention. Or you
              refine the automation & aggregation to cover more scenarios.
            </p>
          </div>
        </div>
      </div>
    </div>;
};

Guardian Ops is an abuse management platform designed for ISPs, Hosting Providers, and DNS Operations. It provides a comprehensive solution for handling abuse reports and automating workflows.

Once Guardian Ops receives your different abuse formats (Email, XARF, Global Reporting), they are parsed into [events](/docs/guardian-ops/reference/event-types).
Some reports can generate a large number of events because Guardian Ops is designed to be as granular as possible. For example, brute force attacks on many different ports from the same machine can lead to multiple events as every port is an event on its own.

Next, each event flows through [Inbound Processing](/docs/guardian-ops/inbound-processing). In Inbound Processing it is crucial to set up [customer resolution](/docs/guardian-ops/customer-resolution) because Guardian Ops needs at least a customer ID for aggregating all those events into customers and cases.

There are two core concepts for customer resolution:

1. [Static resolution](/docs/guardian-ops/customer-resolution)
2. [API resolution](/docs/guardian-ops/customer-resolution)

Static resolution is usually based on IP or domain which is then considered as the customer ID.
When using API resolution, we query your system with event metadata (e.g., one or multiple of IP, domain, date, port, type, etc.) which then responds with a unique customer ID.
We strongly recommend API resolution as it allows the system to track abuse even when IPs, domains, or ports change.
By default, Guardian Ops uses the IP address as the customer ID.

Once a customer ID is present, we can aggregate incoming events into customers and cases.
[Customers](https://app.abusix.com/guardian/ops/customers) are available immediately at [https://app.abusix.com/guardian/ops/customers](https://app.abusix.com/guardian/ops/customers). [Cases](/docs/guardian-ops/cases), however, need at least one [case group](/docs/guardian-ops/inbound-processing) in Inbound Processing.
Also, [automation](/docs/guardian-ops/playbooks) requires cases, as you can attach playbooks only to case groups.

Hence, when cases are configured, the next step is to set up automation in [playbooks](/docs/guardian-ops/playbooks) where you can make API calls to your systems or send emails (soon) using templates.

The [Getting Started](/docs/guardian-ops/getting-started) guide walks you through the main steps of setup:

1. [Configure abuse report forwarding](/docs/guardian-ops/getting-started)
2. [Set up customer resolution](/docs/guardian-ops/customer-resolution)
3. [Configure inbound processing with case groups](/docs/guardian-ops/inbound-processing)
4. [Set up playbooks for automation](/docs/guardian-ops/playbooks)

Below is an overview of Guardian Ops' key features and data pipeline:

<GopsPipeline />

## Getting Started

Ready to start using Guardian Ops? You can:

1. **Access the platform**: Go to [Guardian Ops](https://app.abusix.com/guardian/ops/getting-started) and log in with your existing Abusix account or create a new one.

2. **Follow the setup guide**: Jump to our [Getting Started](/docs/guardian-ops/getting-started/) guide to configure your environment and begin managing abuse reports.

3. **Configure inbound processing**: Set up your [Inbound Processing](/docs/guardian-ops/inbound-processing/) workflow to control how incoming abuse reports are processed, enriched, and assigned to customers.