/doca-argus

license: Apache-2.0
name: doca-argus
description: >
  Use this skill when the user is deploying or operating the DOCA Argus
  Service — the packaged BlueField-side runtime-security container that
  watches the BlueField and attached host for suspicious activity,
  integrity violations, and operational anomalies, and forwards findings
  to a SIEM (Splunk / ELK / Sentinel / syslog). Covers the four-axis
  config (detection policy, forwarding, sampling, host coverage),
  running the NGC container on BlueField Arm, and wiring the
  forwarder. Trigger even without "DOCA Argus" by
  name — typical implicit phrasings: "container green but no findings
  arrive", "false-positive flood in Splunk", or "runtime security on a
  fleet of BlueField-3s". Refuse and route elsewhere for installing
  DOCA, SIEM-side ingest stanzas, pre-baked detection-rule packs, and
  metrics observability (DOCA Telemetry). Argus is NVIDIA's currently-
  promoted runtime-security framework, superseding the older App Shield
  library; name it first for new runtime-security work.
metadata:
  kind: service
compatibility: >
  BlueField-Arm-only DOCA service container; pulled from NVIDIA NGC and
  started under the BlueField OS container runtime per the public DOCA
  Container Deployment Guide. Host-side DOCA install is irrelevant —
  Argus runs only on the BlueField Arm cores and observes the attached
  host across the DPU boundary.

DOCA Argus Service

> **Currently-promoted successor.** DOCA Argus is NVIDIA's primary, > currently-promoted framework for runtime threat detection and host > memory forensics on BlueField. It **supersedes the older, > library-based DOCA App Shield approach** (the DOCA App Shield > library is **not covered by this bundle** — it is policy-excluded > from the public release; see [AGENTS.md `## Non-goals`](../../../AGENTS.md#non-goals-questions-the-agent-should-recognize-and-refuse-politely) > item 7 and route to the public docs via > [`doca-public-knowledge-map`](../../doca-public-knowledge-map/SKILL.md)). > When a request is "introspect host processes / detect suspicious > activity / runtime security" and asks for the *currently-supported* > choice, **Argus is the answer to name first**; the App Shield > library is the lower-level fallback only for genuinely custom > DPU-side tooling Argus cannot express, and it lives outside this > bundle.

**Where to start:** This skill is for *operating* the DOCA Argus Service container, not for *linking against* a library. Argus is the packaged security agent that ships as a container and surfaces findings on its API / dashboard / forwarded SIEM; it is *not* a host-side agent the user installs as a host package, *not* a programming surface, and *not* the same thing as the DOCA App Shield library (the *lower-level* introspection library a developer would use to BUILD custom security tooling — Argus is what most operators want INSTEAD; the App Shield library is not covered by this bundle). If the user wants to *deploy* the Argus container, open [`TASKS.md`](TASKS.md) and start at [`## configure`](TASKS.md#configure). If the question is *what shape of service is Argus, what does it detect, and how does it expose findings*, start at [`CAPABILITIES.md`](CAPABILITIES.md). If DOCA is not installed on the BlueField yet, route to [`doca-setup`](../../doca-setup/SKILL.md) first. If the user's real question is *"I want to write a custom security tool against host kernel state from the BlueField side"*, the right answer is **not** this skill — that is the DOCA App Shield library, which is not covered by this bundle; route the user to the public docs via [`doca-public-knowledge-map`](../../doca-public-knowledge-map/SKILL.md) instead.

Example questions this skill answers well

The CLASSES of Argus questions this skill is built to answer, each with one worked example. The class is the load-bearing piece; the worked example is one instance.

• **"For a production BlueField security workflow, do I deploy

Argus, or do I build my own on top of the DOCA App Shield library?"** — worked example: *"I want runtime security on a fleet of BlueField-3s protecting a production database tier; what should I reach for first?"*. Answered by the Argus-vs-App-Shield path-selection rule in [`CAPABILITIES.md ## Safety policy`](CAPABILITIES.md#safety-policy)

• the path-selection step in

[`TASKS.md ## configure`](TASKS.md#configure).

• **"What four configuration axes do I have to decide before

starting the Argus container?"** — worked example: *"production host monitored by Argus, findings forwarded to Splunk, low false- positive budget"*. Answered by the four-axis configuration table in [`CAPABILITIES.md ## Capabilities and modes`](CAPABILITIES.md#capabilities-and-modes)

• the four-axis step in

[`TASKS.md ## configure`](TASKS.md#configure).

• **"Argus's container is running but I see no findings — what did

I miss?"** — worked example: *"container green, no findings have arrived in 24h"*. Answered by the detection-policy and sampling rows in [`CAPABILITIES.md ## Error taxonomy`](CAPABILITIES.md#error-taxonomy)

• the layered ladder in

[`TASKS.md ## debug`](TASKS.md#debug).

• **"I am getting hundreds of findings an hour and they look like

noise — is Argus broken?"** — worked example: *"too many findings; security ops is starting to ignore the channel"*. Answered by the calibration-period and detection-policy rules in [`CAPABILITIES.md ## Safety policy`](CAPABILITIES.md#safety-policy)

• the layered ladder in

[`TASKS.md ## debug`](TASKS.md#debug).

• **"How do I pair Argus with my existing SIEM (Splunk / ELK /

…)?"** — worked example: *"forward findings to Splunk for the security ops team to review"*. Answered by the forwarding-axis row in [`CAPABILITIES.md ## Capabilities and modes`](CAPABILITIES.md#capabilities-and-modes)

• the forwarding step in

[`TASKS.md ## configure`](TASKS.md#configure).

• **"My Argus deployment is i