doca-argus

# DOCA Argus Service

> **Currently-promoted successor.** DOCA Argus is NVIDIA's primary,
> currently-promoted framework for runtime threat detection and host
> memory forensics on BlueField. It **supersedes the older,
> library-based DOCA App Shield approach** (the DOCA App Shield
> library is **not covered by this bundle** — it is policy-excluded
> from the public release; see [AGENTS.md `## Non-goals`](../../../AGENTS.md#non-goals-questions-the-agent-should-recognize-and-refuse-politely)
> item 7 and route to the public docs via
> [`doca-public-knowledge-map`](../../doca-public-knowledge-map/SKILL.md)).
> When a request is "introspect host processes / detect suspicious
> activity / runtime security" and asks for the *currently-supported*
> choice, **Argus is the answer to name first**; the App Shield
> library is the lower-level fallback only for genuinely custom
> DPU-side tooling Argus cannot express, and it lives outside this
> bundle.

**Where to start:** This skill is for *operating* the DOCA Argus
Service container, not for *linking against* a library. Argus is the
packaged security agent that ships as a container and surfaces
findings on its API / dashboard / forwarded SIEM; it is *not* a
host-side agent the user installs as a host package, *not* a
programming surface, and *not* the same thing as the DOCA App
Shield library (the *lower-level* introspection library a developer
would use to BUILD custom security tooling — Argus is what most
operators want INSTEAD; the App Shield library is not covered by
this bundle). If the user wants to *deploy* the Argus container, open
[`TASKS.md`](TASKS.md) and start at
[`## configure`](TASKS.md#configure). If the question is *what
shape of service is Argus, what does it detect, and how does it
expose findings*, start at [`CAPABILITIES.md`](CAPABILITIES.md).
If DOCA is not installed on the BlueField yet, route to
[`doca-setup`](../../doca-setup/SKILL.md) first. If the user's real
question is *"I want to write a custom security tool against host
kernel state from the BlueField side"*, the right answer is
**not** this skill — that is the DOCA App Shield library, which is
not covered by this bundle; route the user to the public docs via
[`doca-public-knowledge-map`](../../doca-public-knowledge-map/SKILL.md)
instead.

## Example questions this skill answers well

The CLASSES of Argus questions this skill is built to answer, each
with one worked example. The class is the load-bearing piece; the
worked example is one instance.

- **"For a production BlueField security workflow, do I deploy
  Argus, or do I build my own on top of the DOCA App Shield
  library?"** — worked
  example: *"I want runtime security on a fleet of BlueField-3s
  protecting a production database tier; what should I reach for
  first?"*. Answered by the Argus-vs-App-Shield path-selection rule in
  [`CAPABILITIES.md ## Safety policy`](CAPABILITIES.md#safety-policy)
  + the path-selection step in
  [`TASKS.md ## configure`](TASKS.md#configure).
- **"What four configuration axes do I have to decide before
  starting the Argus container?"** — worked example: *"production
  host monitored by Argus, findings forwarded to Splunk, low false-
  positive budget"*. Answered by the four-axis configuration table
  in
  [`CAPABILITIES.md ## Capabilities and modes`](CAPABILITIES.md#capabilities-and-modes)
  + the four-axis step in
  [`TASKS.md ## configure`](TASKS.md#configure).
- **"Argus's container is running but I see no findings — what did
  I miss?"** — worked example: *"container green, no findings have
  arrived in 24h"*. Answered by the detection-policy and sampling
  rows in
  [`CAPABILITIES.md ## Error taxonomy`](CAPABILITIES.md#error-taxonomy)
  + the layered ladder in
  [`TASKS.md ## debug`](TASKS.md#debug).
- **"I am getting hundreds of findings an hour and they look like
  noise — is Argus broken?"** — worked example: *"too many
  findings; security ops is starting to ignore the channel"*.
  Answered by the calibration-period and detection-policy rules in
  [`CAPABILITIES.md ## Safety policy`](CAPABILITIES.md#safety-policy)
  + the layered ladder in
  [`TASKS.md ## debug`](TASKS.md#debug).
- **"How do I pair Argus with my existing SIEM (Splunk / ELK /
  …)?"** — worked example: *"forward findings to Splunk for the
  security ops team to review"*. Answered by the forwarding-axis
  row in
  [`CAPABILITIES.md ## Capabilities and modes`](CAPABILITIES.md#capabilities-and-modes)
  + the forwarding step in
  [`TASKS.md ## configure`](TASKS.md#configure).
- **"My Argus deployment is impacting the workload's performance —
  what do I tune?"** — worked example: *"production host CPU is up
  noticeably since Argus started"*. Answered by the sampling-axis
  row in
  [`CAPABILITIES.md ## Capabilities and modes`](CAPABILITIES.md#capabilities-and-modes)
  + the sampling-tuning row in
  [`TASKS.md ## debug`](TASKS.md#debug).

## Audience

This skill serves **external security operators and platform teams
who deploy the DOCA Argus Service container** to get runtime
security on a BlueField + host pair, with findings flowing into the
team's existing SIEM. Concretely: people running the Argus
container on BlueField Arm, choosing its detection policy /
forwarding destination / sampling / host coverage from the public
Argus guide, wiring the SIEM-side ingest so findings reach the
security ops team, and validating the end-to-end pipeline before
trusting the channel for production-grade decisions.

It is **not** for NVIDIA developers contributing to Argus itself,
and it is **not** a programming guide for *building security tools
on top of* DOCA libraries (that is
[`doca-programming-guide`](../../doca-programming-guide/SKILL.md)
plus the matching `libs/<library>` skill — and for the App Shield
library that custom security tooling builds on, the public docs,
since App Shield is not covered by this bundle). Argus is a
**service**, not a library: the operator runs a container and
consumes findings via