开源 Agent 架构安全运营平台 Argus 采用 MIT 协议发布，支持自托管与企业 AI 治理

什么是 Argus？

Argus 是一款免费、开源且支持完全自托管的安全运营平台。它将你的云环境、身份认证、代码库、设备、网络和 Kubernetes 资产映射到一个统一的“证据图谱”（Evidence Graph）中；能够检测包括高速、AI 驱动型攻击在内的威胁；借助 AI Agent 自动进行分类研判与深入调查；并通过配备人工审批、试运行（Dry Runs）、自动回滚和紧急熔断开关（Kill Switch）的 Action Broker 来修复问题。同时，它还内置了 AI 网关与“影子 AI”（Shadow AI）发现功能，以规范企业内部的 AI 使用。

Argus 可以自主行动吗？这样安全吗？

只有当你主动开启时才可以。自主响应和自主渗透测试默认均为关闭状态，并且需要部署级配置与租户级主动加入（Opt-in）双重确认。自动化工作流（Playbooks）初始以影子模式（Shadow Mode）运行，仅执行可逆操作，设有每小时上限，并会在无人手动确认保留时自动回滚。AI Agent 本身绝不直接执行任何操作：它们仅以只读权限进行调查，只能提出处置建议。每一次变更都必须经过同一个 Action Broker，且紧急熔断开关可随时瞬间终止一切操作。

攻击者能诱骗或对抗 AI 吗？

Argus 在设计之初就假定一定会有人试图攻破它。Agent 读取的所有内容都会被封装并标记为不可信数据，且系统已向 Agent 明确指示：在证据内部发现的指令属于攻击特征。Agent 均经过 Prompt 注入评估套件的测试；由于它们本身没有直接执行权限，即便 Agent 被诱骗，其能做的最多也只是提交一条仍需通过策略校验与人工审批的请求。

攻击模拟器会对生产系统产生影响吗？

没有任何影响。它是在一个完全隔离的隐藏沙盒中重放合成攻击数据，该沙盒完全复刻了你的检测策略设置。它不会向外部发送网络流量，不运行任何实际工具，也绝不触碰任何真实的系统。模拟产生的检测结果不会触发自主响应、告警或发现项。最终你会获得一份覆盖率报告，直观展示哪些攻击会被你的规则捕获，哪些会漏过。

什么是“影子 AI”（Shadow AI），Argus 如何应对？

影子 AI 是指员工在未经企业批准的情况下私自使用外部 AI 工具，通常会粘贴客户数据或内部机密。Argus 会通过分析网络、云环境及单点登录（SSO）数据，自动发现网络中的 AI 服务并生成清单供你审查。此外，其内置的 AI 网关（AI Gateway）能让团队合规调用受许可的 OpenAI 和 Anthropic 模型，支持企业统一托管密钥、配置防数据泄露（DLP）规则、设定用量预算、标记 Prompt 注入行为并生成完整的使用审计日志。

它会替代现有的 SIEM 或 EDR 吗？

它是与它们协同工作的。Argus 可以从包括 CrowdStrike、SentinelOne、GuardDuty、Wazuh 和 CloudTrail 在内的 13 个数据源接入事件；能够通过 CrowdStrike 和 SentinelOne 对受染设备执行隔离控制；并支持向 Slack、Jira、ServiceNow、PagerDuty、电子邮件及 Webhook 发送告警。许多安全团队选择将它与现有工具并行部署，作为将各类证据串联、调查分析并统管响应动作的核心层。

它支持哪些 AI 模型？

支持 Anthropic Claude、OpenAI，或者通过 Ollama 接入本地模型，甚至可以完全不使用大模型。在未配置模型的情况下，专长模块会退回至确定性逻辑运行，因此检测和分类研判依然正常生效。预算管理系统会从执行步数、Token 消耗、耗时和费用多维度对每次 Agent 运行设置上限。

我的数据会流出本地网络吗？

Argus 采用自托管架构，因此平台及其数据全部保留在你的自有基础设施内。唯一的外部调用完全由你自行配置决定：包括它采集数据的云与身份 API、接收告警的通知渠道、公开威胁情报源，以及在你选择托管模型时的对应提供商接口。如果搭配本地模型与离线威胁情报库使用，则绝不会有任何 AI 或情报流量流出你的私有网络。

它准备好投入生产环境了吗？

平台核心功能（多租户、单点登录、角色权限、审计跟踪、作业队列、策略与审批）已在 CI 中基于 SQLite 和 PostgreSQL 完成了端到端测试。与任何安全平台一样，它需要根据你的具体环境进行调优：接入你所使用的采集器、优化检测规则，并在开启任何自动处置操作之前先保持“纯监控模式”（Monitoring-only mode）运行。安装部署服务恰恰覆盖了这些调优环节。需要说明的是，Argus 目前尚不是经过官方认证的产品。

Argus 能否让我们直接通过 SOC 2 或 ISO 27001 合规认证？

没有任何一款软件单凭自身就能做到这一点。Argus 提供针对 SOC 2、NIST 800-171 和 ISO 27001 的控制项映射表，明确指出平台能为哪些控制项提供证据（例如带签名的审计日志、基于角色的访问控制 RBAC 和审批记录）。这能显著加快审计流程，但审计机构依然会全面评估你的整体合规体系。

它的费用是多少？

软件本身基于 MIT 许可证完全免费。你只需承担运行该软件的基础设施成本以及所选 AI 模型的调用费用。如果你需要官方代为安装，我们会在简短沟通你的环境需求后评估范围并报价；而代码、配置和凭据等所有资产始终完全由你掌控。

我是企业主而不是安全工程师，这款产品适合我吗？

如果你的企业拥有值得保护的云账户、员工登录凭据、客户数据或核心代码，那么这份安全防护正是为你准备的。你不需要亲自去运维它。随时预约沟通，告诉我你现有的技术栈，我会坦诚告知你 Argus 是否合适，或者是否有更轻量的方案能更好地满足你的需求。

What is Argus?

Argus is a free, open-source security operations platform you host yourself. It maps your cloud, identity, code, device, network and Kubernetes assets into one evidence graph, detects attacks including fast, AI-driven ones, uses AI agents to triage and investigate, and fixes problems through an action broker with approvals, dry runs, automatic rollback and a kill switch. It also governs your own company's AI use with an AI gateway and shadow-AI discovery.

Can Argus act on its own? Is that safe?

Only if you turn it on. Autonomous response and autonomous pentesting are off by default and need both a deployment setting and a per-tenant opt-in. Playbooks start in shadow mode, run only reversible actions, are capped per hour, and roll back automatically unless someone keeps the change. The AI agents themselves never execute anything: they investigate with read-only access and can only propose actions. Every change goes through the same broker, and the kill switch stops everything instantly.

Can an attacker trick the AI?

Argus is designed on the assumption that someone will try. Everything an agent reads is wrapped and labelled as untrusted data, and the agent is told that instructions found inside evidence are a sign of an attack. The agents are tested against prompt-injection evaluation suites, and because they cannot execute anything themselves, a tricked agent can at most file a request that still has to pass policy and approval.

What does the attack simulator do to my systems?

Nothing. It replays synthetic attack data in a hidden, isolated sandbox that copies your detection settings. It sends no traffic, runs no tools and touches no real system. Simulated detections can't trigger autonomous response, alerts or findings. You get a coverage report showing which attacks your rules would catch and which would get through.

What is shadow AI, and how does Argus help?

Shadow AI is staff using AI tools the business hasn't approved, often by pasting in customer or company data. Argus finds AI services in your network, cloud and SSO data and keeps an inventory you review. Its AI gateway gives your team approved access to OpenAI and Anthropic models with company-held keys, data-loss rules, budgets, prompt-injection flags and a usage log.

Does it replace my SIEM or EDR?

It works with them. Argus takes events in from thirteen sources, including CrowdStrike, SentinelOne, GuardDuty, Wazuh and CloudTrail, can contain devices through CrowdStrike and SentinelOne, and sends alerts to Slack, Jira, ServiceNow, PagerDuty, email and webhooks. Many teams run it alongside existing tools as the layer that connects the evidence, investigates it and governs the response.

Which AI models does it work with?

Anthropic Claude, OpenAI, local models through Ollama, or none at all. With no model configured, the specialists fall back to deterministic logic, so detection and triage still work. Budgets cap every agent run by steps, tokens, time and cost.

Does my data leave my network?

Argus is self-hosted, so the platform and its data stay in your infrastructure. The only outside calls are the ones you set up: the cloud and identity APIs it collects from, the channels you send alerts to, the public threat-intel feeds, and a model provider if you choose a hosted one. With a local model and offline threat-intel files, no AI or intel traffic leaves your network at all.

Is it ready for production?

The platform core (tenancy, sign-in, roles, the audit trail, the job queue, policy and approvals) is tested end to end on SQLite and PostgreSQL in CI. Like any security platform, it should be tuned to your environment: connect the collectors you use, tune the detection rules, and run in monitoring-only mode before enabling any action. That tuning is exactly what the install service covers. Argus is not a certified product.

Does Argus make us SOC 2 or ISO 27001 compliant?

No software does that alone. Argus ships a control mapping for SOC 2, NIST 800-171 and ISO 27001 that shows which controls it can provide evidence for, such as the signed audit trail, role-based access and approval records. That makes the audit faster, but your auditor still assesses your program as a whole.

What does it cost?

The software is free under the MIT license. You pay only for the infrastructure you run it on and any AI model you choose. If you want it installed for you, the install is scoped and priced after a short call about your environment, and you keep everything: the code, the configuration and the credentials.

I'm a business owner, not a security engineer. Is this for me?

If you have cloud accounts, staff logins, customer data or code worth protecting, the protection is for you. You don't need to run it yourself. Book a call, tell me what you use, and I'll tell you plainly whether Argus is the right fit or whether something simpler would serve you better.