An open-source SOC platform that wants to be your SIEM

What it does Argus is a full-stack security operations center built in Python and TypeScript. It ingests alerts, manages tickets and assets through a CMDB, runs detection via Sigma rules, and orchestrates response workflows. An AI assistant with an MCP-style tool registry sits on top to help analysts query context, find similar cases, and extract observables.

The interesting bit Instead of shipping a black-box appliance, the project is organized as loosely coupled Django apps with a Next.js frontend, exposing everything through a unified API layer. That modularity means you can run the whole platform or cherry-pick components—alerts, workflows, or the AI assistant—into an existing SOC.

Key highlights

• Ships with alert ingestion, ticket lifecycle management, CMDB asset linking, and operational dashboards out of the box.
• Supports detection-as-code with Sigma rules and versioned correlation rules.
• Includes a workflow orchestrator for scheduled automation chains tied to alerts and tickets.
• Exposes an MCP-style JSON-RPC tool registry and conversational AI assistant for analyst support.
• Runs via Docker Compose or Kubernetes with PostgreSQL as the primary store and optional Elasticsearch.

Verdict Security teams looking for a modular, self-hosted alternative to commercial SIEMs should evaluate this. If you require a fully supported enterprise product with guaranteed SLAs, you are not the target audience.