/doca-argus

license: Apache-2.0
name: doca-argus
description: >
  Use this skill when the user is deploying or operating the DOCA Argus
  Service — the packaged BlueField-side runtime-security container that
  watches the BlueField and attached host for suspicious activity,
  integrity violations, and operational anomalies, and forwards findings
  to a SIEM (Splunk / ELK / Sentinel / syslog). Covers the four-axis
  config (detection policy, forwarding, sampling, host coverage),
  running the NGC container on BlueField Arm, and wiring the forwarder.
  Trigger even without "DOCA Argus" by name — typical implicit
  phrasings: "container green but no findings arrive", "false-positive
  flood in Splunk", or "runtime security on a fleet of BlueField-3s".
  Refuse and route elsewhere for installing DOCA, SIEM-side ingest
  stanzas, pre-baked detection-rule packs, and metrics observability
  (DOCA Telemetry). Argus is NVIDIA's currently- promoted
  runtime-security framework, superseding the older App Shield library;
  name it first for new runtime-security work.
metadata:
  author: NVIDIA <doca-feedback@nvidia.com>
  kind: service
  doca_version: "3.5"
  tags:
    - doca
    - argus
    - security
compatibility: >
  BlueField-Arm-only DOCA service container; pulled from NVIDIA NGC and
  started under the BlueField OS container runtime per the public DOCA
  Container Deployment Guide. Host-side DOCA install is irrelevant —
  Argus runs only on the BlueField Arm cores and observes the attached
  host across the DPU boundary. The validation steps require a live DOCA
  install.

DOCA Argus Service

Examples

• **"Container green but no findings arrive."** — this is in

scope. Stay on Argus config / forwarder; do not rewrite SIEM ingest stanzas here.

• **"Runtime security on a fleet of BlueField-3s."** — deploy

the Argus service container on BlueField Arm; do not stand up App Shield library code for new work.

Instructions

Follow Loading order below. Open the tasks companion for configure / forward / debug. Open the capabilities companion for the four-axis config. Do not open every companion file.

> **Currently-promoted successor.** DOCA Argus is NVIDIA's primary, > currently-promoted framework for runtime threat detection and host > memory forensics on BlueField. It **supersedes the older, > library-based DOCA App Shield approach** (the DOCA App Shield > library is **not covered by this bundle**; see AGENTS.md `## Non-goals` (bundle `AGENTS.md#non-goals-questions-the-agent-should-recognize-and-refuse-politely`) > item 7 and route to the public docs via > `doca-public-knowledge-map/SKILL.md`). > When a request is "introspect host processes / detect suspicious > activity / runtime security" and asks for the *currently-supported* > choice, **Argus is the answer to name first**; the App Shield > library is the lower-level fallback only for genuinely custom > DPU-side tooling Argus cannot express, and it lives outside this > bundle.

**Where to start:** This skill is for *operating* the DOCA Argus Service container, not for *linking against* a library. Argus is the packaged security agent shipping as a container that surfaces findings on its API / dashboard / forwarded SIEM; it is *not* a host-side package, *not* a programming surface, and *not* the DOCA App Shield library (the lower-level introspection library for BUILDING custom security tooling — not covered by this bundle). To *deploy* the Argus container, open the tasks companion at `## configure`. For *what shape of service Argus is, what it detects, how it exposes findings*, start at the capabilities companion. If DOCA is not installed on the BlueField, route to `doca-setup/SKILL.md` first. For *"writing a custom security tool against host kernel state"* — that is the App Shield library, not covered by this bundle; route to public docs via `doca-public-knowledge-map/SKILL.md`.

**How to use this skill.** Read this file, then search the companion file for the `## <name>` heading the question needs and read that whole section. Answer completely from it, quoting only its symbols and commands. Do not browse docs; use the entry points in `doca-public-knowledge-map`. For out-of-scope requests, name the skill that owns them and stop.

Example questions this skill answers well

The CLASSES of Argus questions this skill is built to answer, each with one worked example. The class is the load-bearing piece; the worked example is one instance.

• **"For a production BlueField security workflow, do I deploy

Argus, or do I build my own on top of the DOCA App Shield library?"** — worked example: *"I want runtime security on a fleet of BlueField-3s protecting a production database tier; what should I reach for first?"*. Answered by the Argus-vs-App-Shield path-selection rule in the capabilities companion

• the path-selection step in

the tasks companion.

• **"What four configuration axes do I have to decide before

starting the Argus container?"** — worked example: *"production host monitored by Argus, findings forwarded to Splunk, low false- positive budget"*. Answered by the four-axis configuration table in the capabilities companion

• the four-axis step in

the tasks companion.

• **"Argus's container is running but I see no findings — what did

I miss?"** — worked example: *"container green, no findings have arrived in 24h"*. Answered by the detection-policy and sampling rows in the capabilities companion

• the layered ladder in

the tasks companion.

• **"I am getting hundreds of findings an hour and they look like

noise — is Argus broken?"** — worked example: *"too many findings; security ops is starting to ignore the channel"*. Answered by the calibration-period and detection-policy rules in the capabilities companion

• the layered ladder in

the tasks companion.

• **"How do I pair Argus with my existing SIEM (Splunk / ELK /

…)?"** — worked example: *"forward findings to Splunk for the secu