Argus

Argus, developed by QoSient, is a network activity logging facility that aims to provide comprehensive network flow data and analytics. According to the vendor, it is primarily used for security, operations, and performance management. Argus is designed to cater to a wide range of organizations, including large enterprises and academic institutions such as US National Laboratories and Universities worldwide. Key users of this software include network security professionals, network operations professionals, IT managers, cybersecurity researchers, and academics in computer networking.

Key Features

ARGUS + ML: According to the vendor, Argus serves as a reliable data source for Machine Learning (ML) enabled network anomaly detection. It is said to provide the necessary network flow data for ML model development, training, optimization, and deployment.

ARGUS Sensor: Argus is described as a network activity audit facility that generates comprehensive network flow data for post-incident network forensics analysis. The vendor claims that it captures and analyzes packet streams to understand normal network behavior and detect anomalies.

ARGUS Clients: Argus offers a set of client programs that enable data management, analytics, and processing. According to the vendor, these clients can collect, enhance, filter, aggregate, compress, and index Argus data. They are said to support various data formats and can store data in databases.

ARGUS + Analytics: The vendor states that Argus data can be utilized for various analytics purposes, such as counting TCP connections, measuring maximum bandwidth, and analyzing network traffic. It is claimed to provide security, operations, and performance metrics to support network management efforts.

ARGUS Detections: According to the vendor, Argus data contains features that can be used for network operations and cybersecurity detections. It is said to support intrusion detection systems and limited Deep Packet Inspection strategies. Integrated detections include keystroke detection and fragmentation overlap detection.

Putting the N in EDR: Argus is described as a lightweight network sensor that can run on Linux, MacOS, and Windows endpoints. The vendor claims that it generates network activity audit logs for all communications on the host, providing network visibility and awareness for each endpoint. It is said to enhance security incident detection.

Argus and Machine Learning: According to the vendor, Argus is considered the preferred network data source for many Machine Learning (ML) Network Intrusion Detection and Anomaly Detection projects. It is claimed to have large data capabilities, rich data models, and flexible data formats, making it suitable for ML model development, training, and optimization.