GitHub - nssriraam/argus: Open-source AWS & Azure cloud forensics & threat detection platform. Features MITRE ATT&CK attack chain correlation, live dashboard, automated PDF reports, and zero infrastructure cost.

Features • Demo • Quick Start • Architecture • Detection Rules • Commands • Contributing

The Problem

Every serious cloud forensics tool costs $50,000+/year.

Every free alternative makes you write SQL queries against raw JSON.

Argus is neither.

Built as a free, open-source alternative to tools like Cado Security and Mitiga — full cloud forensics pipeline on your laptop, zero cost, zero infrastructure.

What Argus Does


🔍 Multi-Cloud Ingestion	AWS CloudTrail + Azure Activity Logs
🛡️ Detection Engine	26+ MITRE ATT&CK rules across 7 tactics
⛓️ Attack Chain Correlation	Links isolated events into kill chains
🧠 Behavioral Baseline	Per-entity anomaly detection
📊 Live Dashboard	Flask dashboard, no Splunk needed
📝 PDF Reporting	Executive + Technical reports in one command
🔔 Real-Time Alerts	Discord, Slack, ntfy routing
🔒 Chain of Custody	SHA-256 evidence integrity + audit trail
🗂️ Case Management	Multi-tenant forensic case lifecycle
🌐 Threat Intelligence	VirusTotal, AbuseIPDB, offline OSINT feeds

Compared To

	Argus	Cado Security	Splunk	ScoutSuite
Cost	Free	$50k+/yr	$100k+/yr	Free
Attack Chain Correlation	✅	✅	✅	❌
Case Management	✅	✅	✅	❌
Works Offline	✅	❌	❌	✅
Azure Support	✅	✅	✅	✅
Zero Infrastructure	✅	❌	❌	✅
Evidence Integrity	✅	✅	✅	❌
PDF Reports	✅	✅	✅	❌
Setup Time	2 minutes	Days	Weeks	30 min

Demo

💡 Note: Click the image above to watch the full Argus demo on YouTube!

Screenshots

Interactive CLI

Live Dashboard

Detection Findings

Forensic PDF Report

Features

🔍 Multi-Cloud Ingestion

AWS CloudTrail — Ingest exported JSON log bundles or poll CloudTrail in real-time via boto3
Azure Activity Logs — Parse Azure Monitor / Activity Log JSON exports with automatic schema normalization
Deduplication engine prevents double-ingestion across overlapping exports

🛡️ MITRE ATT&CK Detection Engine

26+ detection rules spanning 7 tactic categories:

Tactic	AWS Rules	Azure Rules
Initial Access	Root login, brute-force detection, impossible travel	—
Privilege Escalation	Policy attachment, inline policy injection, user creation	Role assignment, owner escalation
Defense Evasion	Trail deletion, logging disabled, alarm suppression	Diagnostic deletion, NSG modification, policy tampering
Credential Access	Access key creation, root console login, secrets retrieval	Key Vault secret access
Lateral Movement	Cross-account `AssumeRole`, cross-region activity	—
Exfiltration	S3 public access, bucket policy change, large download	Storage account modification
Persistence	—	Guest user invitation

⛓️ Attack Chain Correlation

Automatically links isolated findings into multi-step attack narratives
10 pre-built chain patterns (6 AWS + 4 Azure) with configurable time windows
Detects classic kill chains: Initial Access → Privilege Escalation → Persistence → Defense Evasion

🧠 Behavioral Baseline Analysis

Builds per-entity behavioral profiles from historical data
Flags 4 anomaly types: time, region, IP address, and new action type
Adapts baselines as new data is ingested — no static thresholds

📊 Real-Time Web Dashboard

Flask-powered single-page dashboard with auto-refresh (5-second polling)
Severity breakdown, top entities, event timeline, and geographic distribution
Dedicated views: Findings, Attack Chains, Event Explorer, Entity Profiles

🔗 Threat Intelligence Integration

VirusTotal — Automated IP/hash reputation scoring via API
AbuseIPDB — Malicious IP confidence scoring
Offline OSINT Feeds — Tor exit nodes (torproject.org) and Feodo Tracker botnet C2 IPs (abuse.ch)
Risk scores dynamically boosted when source IPs match known threat indicators

📋 Case Management

Full forensic case lifecycle: OPEN → INVESTIGATING → INGESTED → CLOSED → ARCHIVED
Multi-tenant: run parallel investigations with isolated data per case
Analyst notes, timestamps, and priority tagging (CRITICAL / HIGH / MEDIUM / LOW)

📝 Reporting & Export

PDF Reports — Executive summary, MITRE heatmap, risk scores, IOC appendix, and remediation playbooks (via ReportLab)
IOC Extraction — Automated export of suspicious IPs, high-risk entities, and observed MITRE techniques
Remediation Engine — Maps each finding to specific AWS CLI remediation commands

🔔 Alerting

Real-time alert routing to Discord webhooks
Configurable severity threshold — only route what matters
Deduplication prevents alert fatigue

🎯 Live Monitoring

Background daemon polls AWS CloudTrail LookupEvents API at configurable intervals
Automatic ingestion, detection, and alerting in a single pipeline
Smart cloud detection: blocks AWS daemon if active case contains Azure logs

🔒 Evidence Integrity

SHA-256 hashing — Every ingested event is hashed at ingestion time; duplicates are rejected at the database layer via UNIQUE constraints
Immutable evidence store — Events are written once via INSERT OR IGNORE; no UPDATE or DELETE operations are performed on raw event data
Case isolation — Each case maintains its own partitioned dataset; case delete surgically removes only the target case without touching other investigations
Audit trail — All events carry ingested_at timestamps, and the verify command validates record counts and hash consistency across the evidence store
Chain of custody — Case lifecycle states (OPEN → INVESTIGATING → CLOSED → ARCHIVED) with analyst attribution, timestamped notes, and priority classification provide a defensible forensic record
Hardened Architecture — Fully parameterized SQL queries prevent injection, and strict deterministic cryptographic hashing prevents cross-process collision vulnerabilities

Quick Start

Prerequisites

Python 3.10+
AWS credentials configured (aws configure) for live CloudTrail monitoring
(Optional) VirusTotal / AbuseIPDB API keys for threat intelligence enrichment

Installation

git clone https://github.com/nssriraam/argus.git
cd argus
pip install -r requirements.txt
pip install -e .

Configuration

# Copy and customize the config file
cp argus.yaml.example argus.yaml

# Set up environment variables (optional)
cp .env.example .env
# Edit .env with your VIRUSTOTAL_API_KEY

Launch

argus

You'll be greeted by the interactive shell:

   █████╗ ██████╗  ██████╗ ██╗   ██╗███████╗
  ██╔══██╗██╔══██╗██╔════╝ ██║   ██║██╔════╝
  ███████║██████╔╝██║  ███╗██║   ██║███████╗
  ██╔══██║██╔══██╗██║   ██║██║   ██║╚════██║
  ██║  ██║██║  ██║╚██████╔╝╚██████╔╝███████║
  ╚═╝  ╚═╝╚═╝  ╚═╝ ╚═════╝  ╚═════╝ ╚══════╝
  1 0 0   E Y E S   O N   Y O U R   C L O U D

argus [CASE-DEFAULT]>

Uninstallation

To remove Argus and its CLI command from your system:

pip uninstall argus-forensics

First Investigation

# 1. Create a case
argus> case new

# 2. Ingest AWS CloudTrail logs
argus> ingest --file path/to/cloudtrail.json

# 3. Ingest Azure Activity Logs
argus> ingest-azure --file path/to/azure-activity.json

# 4. Run the detection engine
argus> analyze

# 5. View findings, chains, timeline
argus> findings
argus> chains
argus> timeline

# 6. Launch the live dashboard
argus> dashboard

# 7. Generate a PDF report
argus> report

Architecture

argus/
├── argus.py                  # CLI entry point & interactive shell
├── argus.yaml.example        # Configuration template
├── setup.py                  # Package configuration
├── requirements.txt          # Dependencies
│
├── ingestion/                # Log ingestion pipelines
│   ├── local_ingestor.py     # AWS CloudTrail JSON parser
│   ├── azure_ingestor.py     # Azure Activity Log normalizer
│   ├── normalizer.py         # Event schema normalization
│   └── live_monitor.py       # Real-time CloudTrail polling daemon
│
├── detection/                # Detection engine
│   ├── rule_engine.py        # Core engine — orchestrates all rule modules
│   ├── remediation.py        # AWS CLI remediation command mapper
│   └── rules/                # MITRE ATT&CK detection rules
│       ├── azure_rules.py         # Azure-specific detections
│       ├── credential_access.py   # T1552, T1078
│       ├── defense_evasion.py     # T1562
│       ├── exfiltration.py        # T1537
│       ├── initial_access.py      # T1078, T1110
│       ├── lateral_movement.py    # T1548, T1550
│       └── privilege_escalation.py # T1098, T1078
│
├── analysis/                 # Advanced analysis modules
│   ├── attack_chain.py       # Multi-step attack chain correlator
│   ├── behavioral_baseline.py # Per-entity behavioral profiling
│   ├── threat_intel.py       # VirusTotal, AbuseIPDB, OSINT feeds
│   └── timeline_builder.py   # Forensic timeline reconstruction
│
├── dashboard/                # Web-based dashboard
│   ├── server.py             # Flask API server
│   └── index.html            # Single-page dashboard UI
│
├── reporting/                # Output & export
│   ├── pdf_generator.py      # Executive PDF report builder
│   ├── ioc_extractor.py      # IOC list export
│   └── alerter.py            # Discord/Slack/ntfy alert routing
│
├── db/                       # Data layer
│   └── storage.py            # SQLite schema, queries, migrations
│
└── data/                     # Sample data & generators
    ├── generate_sample_logs.py      # AWS CloudTrail sample generator
    └── generate_azure_sample.py     # Azure Activity Log sample generator

Commands

Investigation

Command	Description
`case new`	Create a new forensic case
`case list`	List all cases
`case show --case ID`	Show case details and notes
`case note --case ID --text 'note'`	Add an analyst note
`case close --case ID`	Close a case
`case archive --case ID`	Archive a case
`case delete --case ID`	Surgically delete all data for a case

Data

Command	Description
`ingest --file FILE`	Ingest AWS CloudTrail JSON logs
`ingest-azure --file FILE`	Ingest Azure Activity Log JSON
`analyze`	Run MITRE ATT&CK detection engine
`verify`	Verify data integrity

Detection

Command	Description
`findings`	View all detection findings
`chains`	View correlated attack chains
`timeline`	Forensic event timeline
`baseline`	Behavioral anomaly report
`entity --name NAME`	Entity profile lookup

Output

Command	Description
`report`	Generate executive PDF report
`dashboard`	Launch web dashboard on `localhost:5000`

Intelligence

Command	Description
`update-intel`	Refresh offline OSINT threat feeds

System

Command	Description
`listen`	Start real-time AWS CloudTrail monitoring
`stop`	Stop the background monitoring daemon
`reset`	Reset the database (requires confirmation)
`status`	System status and case overview
`help`	Show all commands

Detection Rules

AWS CloudTrail (18 rules)

Rule	Severity	MITRE Technique
`StopLogging`	CRITICAL	T1562.008
`DeleteTrail`	CRITICAL	T1562.008
`AlarmDeletion`	HIGH	T1562
`AttachUserPolicy`	HIGH	T1078.004
`PutUserPolicy`	HIGH	T1078.004
`CreateAdminUser`	MEDIUM	T1136.003
`AddUserToGroup`	MEDIUM	T1078.004
`CreateAccessKey`	HIGH	T1098.001
`RootConsoleLogin`	CRITICAL	T1078.001
`GetSecretValue`	HIGH	T1552.001
`LoginFailures`	MEDIUM	T1110
`RootLogin`	CRITICAL	T1078.001
`ImpossibleTravel`	HIGH	T1078
`S3BucketPolicyChange`	HIGH	T1537
`S3PublicAccess`	CRITICAL	T1537
`LargeS3Download`	MEDIUM	T1530
`AssumeRoleExternal`	MEDIUM	T1548.005
`CrossRegionActivity`	MEDIUM	T1078

Azure Activity Logs (8 rules)

Rule	Severity	MITRE Technique
`AzureRoleAssignmentCreated`	HIGH	T1098.003
`AzurePolicyAssignment`	MEDIUM	T1562
`AzureDiagnosticDeleted`	CRITICAL	T1562.008
`AzureKeyVaultAccess`	HIGH	T1552.001
`AzureStorageModified`	MEDIUM	T1537
`AzureNSGModified`	HIGH	T1562.007
`AzureGuestUserInvited`	MEDIUM	T1136.003
`AzureOwnerAdded`	CRITICAL	T1078.004

Attack Chain Patterns

Chain	Steps	Window	Severity
Credential Compromise + Persistence	Root Login → Access Key Created	60 min	CRITICAL
Defense Evasion + Priv Esc	Stop Logging → Attach Policy	120 min	CRITICAL
Classic Cloud Kill Chain	Root Login → Policy → Key → Stop Logging	180 min	CRITICAL
Data Exfiltration Setup	S3 Policy Change → External Download	60 min	CRITICAL
Trail Destruction	Stop Logging → Delete Trail	30 min	CRITICAL
Azure Privilege Escalation	Role Assigned → Diagnostics Deleted	120 min	CRITICAL
Azure Identity Persistence	Guest Invited → Role Assigned	60 min	HIGH
Azure Defense Evasion	Policy Changed → Diagnostics Deleted	90 min	CRITICAL
Azure Data Exfiltration	Storage Modified → NSG Changed	120 min	HIGH

Configuration

`argus.yaml`

# Cloud Environment Context
expected_regions:
  - us-east-1
  - us-west-2

# Alerting Channels
alerts:
  discord: "https://discord.com/api/webhooks/..."
  slack: ""
  ntfy: "argus-alerts-prod"

# Alert Threshold
severity_threshold: HIGH

# Threat Intelligence
abuseipdb_api_key: "your-api-key"

# Live Monitoring
monitoring_interval: 60

# Azure Settings
azure:
  enabled: false
  subscription_id: ''
  tenant_id: ''

`.env`

VIRUSTOTAL_API_KEY=your-virustotal-api-key
AWS_DEFAULT_REGION=us-east-1

Tech Stack

Component	Technology
Language	Python 3.10+
CLI Framework	Click + Rich + prompt_toolkit
Database	SQLite (zero-config, portable)
Web Dashboard	Flask + Vanilla JS
PDF Reports	ReportLab
Cloud SDKs	Boto3 (AWS), Azure REST API
Threat Intel	VirusTotal API, AbuseIPDB API, Tor/Feodo OSINT
Alerting	Discord / Slack / ntfy webhooks

Roadmap

v1.1

Live Azure Monitor polling
GCP Cloud Audit Log ingestion
SIGMA rule import/export

v2.0

Elasticsearch backend option
SOAR playbook integration
Kubernetes audit log ingestion
Auto-remediation with approval workflow
Multi-user authentication layer

Contributing

Contributions are welcome! See CONTRIBUTING.md for guidelines on adding new detection rules.

License

This project is licensed under the MIT License.

Built by Sriraam Nagarajan
Cloud Security • Detection Engineering • Incident Response

Name		Name	Last commit message	Last commit date
analysis		analysis
dashboard		dashboard
data		data
db		db
detection		detection
docs/assets		docs/assets
ingestion		ingestion
reporting		reporting
.env.example		.env.example
.gitignore		.gitignore
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
README.md		README.md
argus.py		argus.py
argus.yaml.example		argus.yaml.example
requirements.txt		requirements.txt
setup.py		setup.py

Latest commit

History

Folders and files

Repository files navigation

The Problem

What Argus Does

Compared To

Demo

Screenshots

Interactive CLI

Live Dashboard

Detection Findings

Forensic PDF Report

Features

🔍 Multi-Cloud Ingestion

🛡️ MITRE ATT&CK Detection Engine

⛓️ Attack Chain Correlation

🧠 Behavioral Baseline Analysis

📊 Real-Time Web Dashboard

🔗 Threat Intelligence Integration

📋 Case Management

📝 Reporting & Export

🔔 Alerting

🎯 Live Monitoring

🔒 Evidence Integrity

Quick Start

Prerequisites

Installation

Configuration

Launch

Uninstallation

First Investigation

Architecture

Commands

Investigation

Data

Detection

Output

Intelligence

System

Detection Rules

AWS CloudTrail (18 rules)

Azure Activity Logs (8 rules)

Attack Chain Patterns

Configuration

argus.yaml

.env

Tech Stack

Roadmap

Contributing

License

About

Topics

Resources

Contributing

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages

`argus.yaml`

`.env`