Argus On-Device IDS Agent

Image source: Ancient Origins.

Argus is an on device agent that dynamically maps the host, records intended use, builds mechanical sensors, investigates alerts, and applies policy-approved containment.

Setup

Install Node.js 24 or later. Then run:

cp .env.example .env
npm install
./scripts/setup.sh

The setup wizard inspects the host and asks about its purpose, critical paths, services, local agents, alert contacts, response mode, retention, and review schedule. Agent Mail and S3 are optional.

Response modes:

• report-only: record and report.
• approval-required: ask before containment.
• autonomous-action: apply policy-approved containment.

Setup asks whether Argus may terminate a confirmed malicious process automatically. The default requires approval during the incident.

Linux release

npm run dist
npm install -g ./release/on-device-ids-agent-0.1.0.tgz
sudo ids-agent-install-linux "$PWD/.env"

The installer creates the argus-ids account and starts two systemd services. One service runs Argus. A root broker validates and applies containment. Both services start after a reboot.

macOS

Install from source before the first GitHub release:

git clone https://github.com/theRealestAEP/Argus.git
cd Argus
cp .env.example .env
nano .env
npm ci
npm run build
sudo npm install --global .
sudo ids-agent-install-macos "$PWD/.env"

After release v0.1.0, install its verified archive:

curl -fLo .env https://raw.githubusercontent.com/theRealestAEP/Argus/v0.1.0/.env.example
nano .env
curl -fLO https://github.com/theRealestAEP/Argus/releases/download/v0.1.0/on-device-ids-agent-0.1.0.tgz
curl -fLO https://github.com/theRealestAEP/Argus/releases/download/v0.1.0/SHA256SUMS
shasum -a 256 -c SHA256SUMS
sudo npm install --global ./on-device-ids-agent-0.1.0.tgz
sudo ids-agent-install-macos "$PWD/.env"

The installer creates three LaunchDaemons. The agent runs as your macOS account. A root sensor runs Apple's eslogger. A root broker applies approved containment. All three services start after a reboot.

macOS requires one manual privacy step. Add Argus Sensor from Applications to Full Disk Access when the installer opens System Settings. Then run:

ids-agent access
ids-agent doctor
ids-agent status

doctor reports when Endpoint Security events reach the parser. status shows the event count and the time of the last event.

Argus monitors process execution, credential access, remote login, launch items, account changes, process tampering, malware events, and kernel security changes. It can pause or terminate an exact process, quarantine a persistence file, remove privilege bits, and restart a signed-policy launchd service. Outbound network blocking on macOS remains pending.

Updates

Check GitHub Releases:

ids-agent update-check

Install a checksum-verified update and restart all services:

sudo ids-agent update \
  --state-dir="/Library/Application Support/Argus/state" \
  --env-file="/Library/Application Support/Argus/config/env"

Source installations use git pull, npm ci, and npm run build.

Operations

ids-agent status
ids-agent access
ids-agent doctor
ids-agent re-onboard
ids-agent memory-pack

re-onboard updates policy and recommissions sensors. memory-pack builds signed, grep-friendly long-term memory.

Argus can block an IPv4 destination or pause an identified process. Each action records its target and rollback command.

Warning: The next command can stop a process or block network traffic.

sudo ids-agent contain \
  --state-dir=/var/lib/argus-ids \
  --env-file=/etc/argus-ids/env \
  --plan-file=/secure/path/containment-plan.json

Docker and tests

Run all local checks:

npm run check

Run Linux setup, sensors, and a 32-process containment load test:

npm run test:e2e:linux

Run the interactive Linux onboarding demo:

npm run demo:onboarding:linux

Run the cooperative telemetry smoke test:

export ZAI_API_KEY=...
npm run eval:smoke:cooperative

This Docker test checks the runtime event integration. The service tells Argus the exact process that performed an action. Use it as an integration test.

Run the independent adversarial benchmark on macOS:

brew install lima
npm run eval:adversarial:vm -- rce-exfiltration

The benchmark creates a Linux VM. It runs the target services and Argus as native host services. GLM receives only the public address and a business goal. The scorer uses Linux Audit logs, database access logs, Argus evidence, containment receipts, attacker output, and final host state.

See the security evaluation report for the campaigns, score rules, and current limits. Git ignores all saved evaluation artifacts.

Removal

List installed resources:

ids-agent uninstall-plan

Warning: The next command stops Argus and removes its boot services. It keeps local state and reports.

sudo ids-agent uninstall-service \
  --state-dir=/var/lib/argus-ids \
  --env-file=/etc/argus-ids/env \
  --service-user=argus-ids \
  --service-group=argus-ids

License

Argus uses the MIT License.