Argus: Open Source Security Platform for Agentic Attack Protection

Argus — bu ochiq manbali, multi-tenant xavfsizlik operatsiyalar platformasi boʻlib, u AI agentlari yordamida dalillarni tahlil qiladi, lekin aktivlarga bevosita ta’sir ko‘rsatmaydi. Bu platforma turli xil aktivlarni inventarizatsiya qiladi, xavfsizlik vositalarini boshqaradi va xavfsizlikni ta’minlaydigan turli xil komponentlardan iborat.

Argusning Asosiy Xususiyatlari

Argus platformasi quyidagi asosiy xususiyatlarga ega:

• Inventarizatsiya: Cloud, identifikatsiya, kod, endpoint, tarmoq va Kubernetes aktivlarini inventarizatsiya qilish.
• Tahlil: Swarm, identifikatsiya, cloud, kod va canary signallarini baholash.
• Test Harness: Muayyan xavfsizlik vositalarini ijro etish.
• Agentlar: Triage, tekshirish va qidiruvni amalga oshirish.
• Action Broker: Faqat ushbu komponent aktivlarga ta’sir ko‘rsatishi mumkin.

Platformaning Texnik Tuzilishi

Argus platformasi quyidagi texnik komponentlardan iborat:

• API: FastAPI asosida ishlaydigan API, u session, OIDC+PKCE, TOTP va API kalitlarini qo‘llab-quvvatlaydi.
• Xavfsizlik: RBAC, CSRF, per-principal rate limits, request ids va xavfsizlik boshliqlarini ta’minlaydi.
• Ma’lumotlar bazasi: PostgreSQL va Redis queue dan foydalanadi.
• Audit Chain: HMAC-signed va hash-linked audit chain.
• Worker Processes: Collectors, detections, graph recompute, testing va agentlarni ijro etadi.

Platformaning Xavfsizlik Siyosati

Argus platformasi quyidagi xavfsizlik siyosatlarini ta’minlaydi:

  Browser / SDK / sensors
          |
          v  HTTPS (Caddy, ALB, Front Door or your ingress)
  +-------------------------------------------------------------+
  |  API  (FastAPI)  auth: session / OIDC+PKCE / TOTP / API keys |
  |  RBAC (viewer < analyst < operator < admin < owner), CSRF,   |
  |  per-principal rate limits, request ids, security headers    |
  +------+------------------+------------------+----------------+
         |                  |                  |
   PostgreSQL           Redis queue        Audit chain
   (tenant_id on       (leases, retries,   (hash-linked per tenant,
    every table)        python -m          HMAC, JSONL / S3 Object
                        app.worker)        Lock / Azure immutable)
         |                  |
  +------+------------------+----------------------------------+
  |  Worker processes run the same handlers as the API:        |
  |   collectors.run   detections.run / baselines              |
  |   graph.recompute  testing.run   agents.run                |
  +------------------------------------------------------------+
         |
         v  agents call propose_action only -> ActionRequest(pending)
  Action broker (separate policy, approvals, dry run, rollback, kill switch)

• Agentlar hech qachon bevosita amalga oshirmaydi; ular faqat pending request yaratadi.
• Agentlar tomonidan o‘qilgan ma’lumotlar untrusted sifatida ko‘rsatiladi.
• Active testing faqat muayyan doiralarda amalga oshiriladi.
• Har bir domain table tenant_id ni o‘z ichiga oladi va scoped helper orqali so‘rovlar amalga oshiriladi.
• Audit chain hash-linked, HMAC-signed va external sinkga mirrorlanadi.

Platformaning Integratsiyasi

Argus platformasi turli xil integratsiyalarni qo‘llab-quvvatlaydi, jumladan:

python -m venv .venv && . .venv/bin/activate        # Windows: .venv\Scripts\activate
pip install -r requirements.txt -r requirements-dev.txt
cp .env.example .env
python scripts/generate_secrets.py --write          # fills the three REPLACE_ values, plus AUDIT_SIGNING_KEY and DATA_ENCRYPTION_KEY when they are empty
uvicorn app.main:app --host 127.0.0.1 --port 8080

• AWS, Azure, GCP, Kubernetes, GitHub, Okta, Entra, osquery, netflow uchun collectors.
• Web baseline, trivy, nuclei, zap, prowler, caldera, semgrep, gitleaks uchun test harness.
• AWS, Azure, GCP, Kubernetes, GitHub, Okta, Entra, Cloudflare, Argus-internal uchun action broker.
• Webhook, Slack, Jira, ServiceNow, PagerDuty, email uchun outbound channels.

Platformaning Talablari

Argus platformasini o‘rnatish uchun quyidagi talablar mavjud:

python scripts/seed_demo.py

• Python 3.11 yoki 3.12.
• Virtual environment yaratish va aktivatsiya qilish.
• Zaruriy paketlarni o‘rnatish.
• .env faylini sozlash.
• Platformani ishga tushirish.

Argus platformasi ochiq manbali boʻlib, foydalanuvchilar uni forklash va kengaytirishlari mumkin. Platformaning asosiy komponentlari SQLite va PostgreSQL da testdan o‘tkazilgan. Cloud va identifikatsiya collectors, shuningdek, action executors faqat recorded fixtures va mocked APIs ga qarshi testdan o‘tkazilgan. Platformaning 12 ta detection rules ham hali optimallashtirilmagan. Foydalanuvchilar platformani o‘z aktivlariga moslashtirishlari va faqat monitoring rejimida ishlatishlari tavsiya etiladi.

python -m pytest -q

Argus platformasi hali ham rivojlanayotgan loyihadir va foydalanuvchilar uni o‘z ehtiyojlariga moslashtirishlari mumkin. Platformaning to‘liq ma’lumotlari GitHub repositoriyasida mavjud.

cp .env.example .env && python scripts/generate_secrets.py --write
docker compose up --build -d
docker compose logs -f api

Argus GitHub sahifasi

# .env: APP_ENV=production COOKIE_SECURE=true BASE_URL=https://host ARGUS_DOMAIN=host ACME_EMAIL=ops@example.com
docker compose -f compose.yaml -f compose.prod.yaml up -d

Asl manba: github.com