Sec-Link/Argus-Agentic-SOC-Platform

Overview

Argus is an open-source AI-native Agentic SOC platform designed for modern security operations. You can deploy it as a complete SOC platform or integrate with your existing security ecosystems.

It provides a complete security operations foundation with:

• ✅AI-powered Investigation
• ✅Security Workflow Automation
• ✅Alert and Incident Management
• ✅Threat Intelligence Enrichment
• ✅Asset Context Management

At the same time, Argus is built with a loosely coupled and API-first architecture, allowing organizations to:

• ✅ Extend Argus with custom security capabilities
• ✅ Integrate Argus into existing SOC ecosystems

---

1. Product Components

The platform consolidates core SOC objects into one product with open-source solutions:

• Alerts: alert ingestion, caching, search, and display
• Tickets: incident/ticket management and collaboration
• CMDB: asset inventory and contextual linking
• Dashboards: operational dashboards and visualizations
• Correlation: correlation rules and analysis
• Workflows / Orchestrator: automation and scheduling
• AI Assistant: security-focused intelligent analysis and MCP tool integration

---

2. Core Capabilities

Security Operations

• Unified alert ingestion and aggregation
• Ticket lifecycle and activity history
• Dashboard-based operational views

Detection

• Out-of-box use cases detection and correlation rules
• Detection-as-code and rule versioning
• Write-once, run-anywhere detection with Sigma rules

Automation

• Workflow orchestration and API-driven calls
• Scheduled task execution and audit logs
• Automation chains for tickets/alerts

AI Features

• Built-in AI Assistant conversational interface
• MCP-style tool registry and JSON-RPC connector
• Ticket-context queries, similar-case retrieval, CMDB queries, and observable extraction

---

3. System Architecture Diagram

Architecture Notes

1. Frontend: Built with Next.js App Router; handles pages, UI composition, and API proxying.
2. API Layer: Django + DRF provide unified business APIs (auth, alerts, tickets, CMDB, workflows, AI).
3. Business Layer: Domain features are organized into Django apps for independent evolution and RBAC.
4. Data Layer: PostgreSQL is the primary datastore; Elasticsearch is an optional alert source.
5. Intelligence Layer: AI Assistant offers conversation and tool-call capabilities, exposing MCP-style interfaces.
6. Automation Layer: Orchestrator and Workflows provide scheduled execution, orchestration, and audit trails.

More information: https://github.com/Sec-Link/Argus-Agentic-SOC-Platform/blob/main/docs/architecture.md

---

4. Tech Stack

Frontend

• Next.js 15
• React 18
• Ant Design 5

Backend

• Django 6
• Django REST Framework
• DRF Token Authentication

Data / Infrastructure

• PostgreSQL 16 (optional)
• Elasticsearch (optional)

---

5. Repository Layout

Argus-Agentic-SOC-Platform/
├── backend/                  # Django backend
│   ├── accounts/
│   ├── alerts/
│   ├── ai_assistant/
│   ├── cmdb/
│   ├── correlation/
│   ├── dashboards/
│   ├── integrations/
│   ├── orchestrator/
│   ├── tickets/
│   ├── workflow_interfaces/
│   ├── workflows/
│   └── siem_project/         # Django project settings / urls
├── frontend/                 # Next.js frontend
│   └── src/
│       ├── app/
│       ├── components/
│       ├── modules/
│       ├── services/
│       └── lib/
├── k8s/                      # Kubernetes manifests
├── docker-compose.dev.yml    # Dev compose
├── docker-compose.prod.yml   # Prod compose
├── env.example               # Env template
└── makefile                  # Helper targets

---

6. User Manual

https://sec-link.github.io/Argus-Agentic-SOC-Platform/zh/overview/

7. API and access

The backend uses /api/v1/ as the API prefix. Main areas include:

• /api/v1/auth/: login, logout, register, OTP
• /api/v1/alerts/: alerts capabilities
• /api/v1/tickets/: ticketing capabilities
• /api/v1/cmdb/: asset management
• /api/v1/workflows/: workflow capabilities
• /api/v1/integrations/: integration config and tests
• /api/v1/ai-assistant/: AI assistant and tooling
• /api/v1/mcp/: MCP JSON-RPC and tool registry

The frontend proxies /api/v1/* requests via a Next.js route handler to the backend service, centralizing browser-side API access.

More information: https://github.com/Sec-Link/Argus-Agentic-SOC-Platform/blob/main/docs/api-overview.md

---

8. Deployment

Docker Compose

• docker-compose.dev.yml: local development
• docker-compose.prod.yml: production container setup

Accessing Docker Hub from Mainland China

For users in mainland China, if Docker Hub is slow or unreachable, specify an accessible, trusted registry or Docker Hub mirror using IMAGE_REGISTRY, without editing the Dockerfiles:

# Use Docker Hub by default.
make build-dev

# Specify a registry prefix; replace the example with an accessible registry.
make build-dev IMAGE_REGISTRY=registry.example.com/dockerhub/library
make build-prod IMAGE_REGISTRY=registry.example.com/dockerhub/library

# Backend-only and frontend-only updates are also supported.
make build-backend-prod IMAGE_REGISTRY=registry.example.com/dockerhub/library
make build-frontend-prod IMAGE_REGISTRY=registry.example.com/dockerhub/library

• The default is docker.io/library. Include the actual repository namespace, without https:// or a trailing /; the example address is only a placeholder.
• The registry must provide python:3.13-slim, node:24-alpine3.24, alpine:3.24, and postgres:16 under that prefix.
• Authenticate private registries with docker login; do not put passwords or tokens in IMAGE_REGISTRY.
• Use export IMAGE_REGISTRY=your-registry-prefix to keep the selection in the current shell, and unset IMAGE_REGISTRY to restore the default. Make does not read this variable from the project's .env file.
• This variable only changes image repository paths. It does not configure Docker daemon mirrors or change pip, npm, apt, or apk package sources.

Kubernetes

The k8s/ directory contains basic deployment manifests:

• k8s/backend-deploy.yaml
• k8s/frontend-deploy.yaml
• k8s/postgres-deploy.yaml

---

9. Security & Hardening

In production we recommend:

• Use a secure random SECRET_KEY.
• Precisely set ALLOWED_HOSTS and CSRF_TRUSTED_ORIGINS.
• Add backups and monitoring for DB, object storage, and logs.
• Configure access boundaries, auditing, and least-privilege for AI/MCP features.

10. Contribution

We welcome contributions! Please refer to our CONTRIBUTING.md for more information.

Join our community and help us make the project more powerful, reliable, and accessible. If Argus has been helpful to you, please consider giving us a ⭐ on GitHub and sharing it with others. Together, we can build a safer and more secure digital world.

Contributors

---