Argus is an open-source AI-native Agentic SOC platform designed for modern security operations. You can deploy it as a complete SOC platform or integrate with your existing security ecosystems.
It provides a complete security operations foundation with:
- ✅AI-powered Investigation
- ✅Security Workflow Automation
- ✅Alert and Incident Management
- ✅Threat Intelligence Enrichment
- ✅Asset Context Management
At the same time, Argus is built with a loosely coupled and API-first architecture, allowing organizations to:
- ✅ Extend Argus with custom security capabilities
- ✅ Integrate Argus into existing SOC ecosystems
The platform consolidates core SOC objects into one product with open-source solutions:
- Alerts: alert ingestion, caching, search, and display
- Tickets: incident/ticket management and collaboration
- CMDB: asset inventory and contextual linking
- Dashboards: operational dashboards and visualizations
- Correlation: correlation rules and analysis
- Workflows / Orchestrator: automation and scheduling
- AI Assistant: security-focused intelligent analysis and MCP tool integration
- Unified alert ingestion and aggregation
- Ticket lifecycle and activity history
- Dashboard-based operational views
- Out-of-box use cases detection and correlation rules
- Detection-as-code and rule versioning
- Write-once, run-anywhere detection with Sigma rules
- Workflow orchestration and API-driven calls
- Scheduled task execution and audit logs
- Automation chains for tickets/alerts
- Built-in AI Assistant conversational interface
- MCP-style tool registry and JSON-RPC connector
- Ticket-context queries, similar-case retrieval, CMDB queries, and observable extraction
- Frontend: Built with Next.js App Router; handles pages, UI composition, and API proxying.
- API Layer: Django + DRF provide unified business APIs (auth, alerts, tickets, CMDB, workflows, AI).
- Business Layer: Domain features are organized into Django apps for independent evolution and RBAC.
- Data Layer: PostgreSQL is the primary datastore; Elasticsearch is an optional alert source.
- Intelligence Layer: AI Assistant offers conversation and tool-call capabilities, exposing MCP-style interfaces.
- Automation Layer: Orchestrator and Workflows provide scheduled execution, orchestration, and audit trails.
More information: https://github.com/Sec-Link/Argus-Agentic-SOC-Platform/blob/main/docs/architecture.md
- Next.js 15
- React 18
- Ant Design 5
- Django 6
- Django REST Framework
- DRF Token Authentication
- PostgreSQL 16 (optional)
- Elasticsearch (optional)
Argus-Agentic-SOC-Platform/
├── backend/ # Django backend
│ ├── accounts/
│ ├── alerts/
│ ├── ai_assistant/
│ ├── cmdb/
│ ├── correlation/
│ ├── dashboards/
│ ├── integrations/
│ ├── orchestrator/
│ ├── tickets/
│ ├── workflow_interfaces/
│ ├── workflows/
│ └── siem_project/ # Django project settings / urls
├── frontend/ # Next.js frontend
│ └── src/
│ ├── app/
│ ├── components/
│ ├── modules/
│ ├── services/
│ └── lib/
├── k8s/ # Kubernetes manifests
├── docker-compose.dev.yml # Dev compose
├── docker-compose.prod.yml # Prod compose
├── env.example # Env template
└── makefile # Helper targets
https://sec-link.github.io/Argus-Agentic-SOC-Platform/zh/overview/
The backend uses /api/v1/ as the API prefix. Main areas include:
/api/v1/auth/: login, logout, register, OTP/api/v1/alerts/: alerts capabilities/api/v1/tickets/: ticketing capabilities/api/v1/cmdb/: asset management/api/v1/workflows/: workflow capabilities/api/v1/integrations/: integration config and tests/api/v1/ai-assistant/: AI assistant and tooling/api/v1/mcp/: MCP JSON-RPC and tool registry
The frontend proxies /api/v1/* requests via a Next.js route handler to the backend service, centralizing browser-side API access.
More information: https://github.com/Sec-Link/Argus-Agentic-SOC-Platform/blob/main/docs/api-overview.md
docker-compose.dev.yml: local developmentdocker-compose.prod.yml: production container setup
For users in mainland China, if Docker Hub is slow or unreachable, specify an
accessible, trusted registry or Docker Hub mirror using IMAGE_REGISTRY, without
editing the Dockerfiles:
# Use Docker Hub by default.
make build-dev
# Specify a registry prefix; replace the example with an accessible registry.
make build-dev IMAGE_REGISTRY=registry.example.com/dockerhub/library
make build-prod IMAGE_REGISTRY=registry.example.com/dockerhub/library
# Backend-only and frontend-only updates are also supported.
make build-backend-prod IMAGE_REGISTRY=registry.example.com/dockerhub/library
make build-frontend-prod IMAGE_REGISTRY=registry.example.com/dockerhub/library- The default is
docker.io/library. Include the actual repository namespace, withouthttps://or a trailing/; the example address is only a placeholder. - The registry must provide
python:3.13-slim,node:24-alpine3.24,alpine:3.24, andpostgres:16under that prefix. - Authenticate private registries with
docker login; do not put passwords or tokens inIMAGE_REGISTRY. - Use
export IMAGE_REGISTRY=your-registry-prefixto keep the selection in the current shell, andunset IMAGE_REGISTRYto restore the default. Make does not read this variable from the project's.envfile. - This variable only changes image repository paths. It does not configure Docker daemon mirrors or change pip, npm, apt, or apk package sources.
The k8s/ directory contains basic deployment manifests:
k8s/backend-deploy.yamlk8s/frontend-deploy.yamlk8s/postgres-deploy.yaml
In production we recommend:
- Use a secure random
SECRET_KEY. - Precisely set
ALLOWED_HOSTSandCSRF_TRUSTED_ORIGINS. - Add backups and monitoring for DB, object storage, and logs.
- Configure access boundaries, auditing, and least-privilege for AI/MCP features.
We welcome contributions! Please refer to our CONTRIBUTING.md for more information.
Join our community and help us make the project more powerful, reliable, and accessible. If Argus has been helpful to you, please consider giving us a ⭐ on GitHub and sharing it with others. Together, we can build a safer and more secure digital world.
Contributors