Sec-Link/Argus-Agentic-SOC-Platform

An open source AI-native agentic SOC platform

Argus – Open‑Source AI‑Native SOC Platform

What it is – Argus is a full‑stack, open‑source Security Operations Center (SOC) system that embeds generative‑AI assistants into the classic SOC workflow. It bundles alert ingestion, ticketing, asset inventory, correlation rules, dashboards, and automation, while exposing an AI Assistant that can answer queries, retrieve similar cases, and invoke tools via a JSON‑RPC‑style “MCP” interface.

Why it matters – Modern SOCs are drowning in alerts. By making the platform AI‑native and API‑first, Argus lets security teams:

  • Ask natural‑language questions about an incident (e.g., “What other alerts involve the same IP?”) and get concise, context‑aware answers.
  • Automate repetitive steps with workflow orchestration that can be triggered from the UI or the AI assistant.
  • Extend the system with custom detection rules (Sigma), integrations, or new AI‑driven tools without touching the core code.

Core components

Component Role
Frontend (Next.js 15 + React 18 + Ant Design) Web UI for alerts, tickets, dashboards, workflow builder, and the chat‑style AI assistant.
Backend API (Django 6 + DRF) Unified REST endpoints (/api/v1/*) for auth, alerts, tickets, CMDB, workflows, integrations, and the AI assistant.
Data layer PostgreSQL 16 stores core objects; Elasticsearch can be added as an optional alert source.
AI Assistant Conversational layer that can query tickets, CMDB, retrieve similar cases, and call registered tools via a JSON‑RPC “MCP” registry.
Orchestrator / Workflows Scheduler and execution engine for automation chains, with audit logs.
Correlation engine Out‑of‑the‑box detection rules (Sigma) and versioned “detection‑as‑code”.

Key capabilities

  • AI‑powered investigation – natural‑language queries, case similarity search, and tool‑calling from the chat UI.
  • Security workflow automation – drag‑and‑drop or code‑defined workflows that can create tickets, enrich alerts, or run custom scripts.
  • Alert & incident management – ingestion, pagination, activity history, and collaboration on tickets.
  • Threat intelligence enrichment – built‑in enrichment pipelines and easy integration of external feeds.
  • Asset context (CMDB) – inventory of assets linked to alerts and tickets for richer investigations.

Architecture at a glance

  1. Frontend proxies API calls to the backend, handling authentication and UI rendering.
  2. Backend (Django + DRF) implements business logic, RBAC, and the AI‑assistant endpoints.
  3. Data lives in PostgreSQL; Elasticsearch can be used for fast alert search.
  4. Intelligence layer hosts the AI assistant and its tool‑registry.
  5. Automation layer runs scheduled workflows and orchestrates external calls.

Getting started

  1. Clone the repo and copy env.example to .env (set secrets, DB connection, etc.).
  2. For quick local testing, run docker-compose.dev.yml – it spins up PostgreSQL, the Django API, and the Next.js UI.
  3. Access the UI at http://localhost:3000 and log in via the provided auth endpoints.
  4. Explore the AI Assistant tab to ask questions about alerts or assets, or to invoke registered tools.
  5. Extend the platform by adding custom Django apps, new Sigma detection rules, or additional AI‑driven tool plugins.

Who should use it

  • Security operations teams that want an open‑source SOC with built‑in AI assistance.
  • Developers building custom detection or response tooling who need a modular, API‑first backend.
  • Organizations looking to replace commercial SOC products with a self‑hosted, extensible stack.

Documentation & community

Bottom line – Argus combines the traditional SOC toolbox (alerts, tickets, CMDB, dashboards) with a conversational AI layer and a modern, container‑ready architecture, giving security teams a flexible, open‑source foundation for next‑generation incident response.

Related

  • Project
    beenuar/AiSOC

    An open-source, self-hostable AI Security Operations Center that automates security telemetry ingestion, threat detection, and AI-driven investigation with human-approved responses.

  • Project
    FunnyWolf/agentic-soc-platform

    An open-source security operations platform that uses Agentic AI to automate alert triage, investigation, and knowledge accumulation for security teams.

  • Project
    Vigil-SOC/vigil

    An open-source AI SOC that uses specialized AI agents and Markdown-based workflows to automate security alert triage, investigation, and response.

  • Project
    DevYangJC/Argus

    Argus is an open‑source, enterprise‑grade RAG platform that ingests private documents, builds both vector and keyword indexes, and answers questions with a LLM that must cite real sources. It includes a Spring AI‑based ReactAgent for chat, hybrid retrieval with RRF fusion, multi‑level evidence scoring, role‑based security, and a Vue 3 front‑end.

  • Project
    keephq/keep

    An open-source AIOps and alert management platform that centralizes, deduplicates, and uses AI to correlate and summarize alerts from multiple observability tools.