Sec-Link/Argus-Agentic-SOC-Platform

An open source AI-native agentic SOC platform

What it solves

Argus is an open-source, AI-native Security Operations Center (SOC) platform. It addresses the complexity of modern security operations by consolidating alert ingestion, incident management, asset context, and threat intelligence into a single, unified platform that can either stand alone or integrate with existing security ecosystems.

How it works

The platform uses a loosely coupled, API-first architecture consisting of a Next.js frontend and a Django backend. It integrates several core components:

  • Security Operations: Manages the lifecycle of alerts and tickets, providing operational dashboards for visibility.
  • Detection: Implements detection-as-code using Sigma rules for cross-platform compatibility.
  • Automation: Uses an orchestrator to execute scheduled tasks and automation chains for alerts and tickets.
  • AI Assistant: A conversational interface that utilizes an MCP-style tool registry and JSON-RPC connector to perform ticket-context queries, retrieve similar cases, and extract observables from CMDB data.

Who it’s for

Security analysts and organizations looking for an open-source alternative to traditional SOC platforms that want to integrate AI-driven investigation and automated workflows into their security monitoring.

Highlights

  • AI-Native Investigation: Built-in AI assistant with tool-calling capabilities for intelligent analysis.
  • Detection-as-Code: Support for Sigma rules to write once and run anywhere.
  • Workflow Orchestration: API-driven automation chains for incident response.
  • Extensible Architecture: API-first design allowing for custom security capabilities and easy integration.

Related

  • Project
    beenuar/AiSOC

    An open-source, self-hostable AI SOC that automates security event triage and investigation with a fully transparent, replayable decision ledger.

  • Project
    FunnyWolf/agentic-soc-platform

    An open-source security operations platform that uses Agentic AI to automate alert triage, investigation, and knowledge accumulation for security teams.

  • Project
    keephq/keep

    An open-source AIOps and alert management platform that centralizes, deduplicates, and uses AI to correlate and summarize alerts from multiple observability tools.

  • Project
    Kritt-ai/open-kritt

    An open-source security research platform that orchestrates AI agents to find, validate, and rank vulnerabilities in codebases using focused, parallelized workflows.

  • Project
    DevYangJC/Argus

    Argus is an open‑source, enterprise‑grade RAG platform that ingests private documents, builds both vector and keyword indexes, and answers questions with a LLM that must cite real sources. It includes a Spring AI‑based ReactAgent for chat, hybrid retrieval with RRF fusion, multi‑level evidence scoring, role‑based security, and a Vue 3 front‑end.