ARGUS: Autonomous threat intelligence platform

In pictures

Demo · 5:35A five-minute tour of ARGUS: the problem it solves, its seven-agent pipeline from STIX 2.1 ingestion to ATT&CK mapping, prediction and self-validation, then the live analyst dashboard.

The ARGUS live feed: incoming indicators (hashes, domains, URLs, IP addresses) each with its type, a confidence bar and the malware family it belongs to

The ARGUS MITRE ATT&CK heatmap: techniques observed across campaigns by tactic, with the detail of technique T1027, Obfuscated Files or Information

An ARGUS executive threat report with its kill-chain progress and predicted next targets, beside the Sigma detection rule ARGUS generated for the campaign

The ARGUS self-learning view: agent prompt versions, the top community reviewers and the latest predictions waiting to be validated

What was built

Built a multi-agent cyber threat intelligence platform that polls 7 open threat feeds every 60 seconds (AlienVault OTX, ThreatFox, URLhaus, Feodo Tracker, MalwareBazaar, CISA KEV, MISP CIRCL), normalises every indicator to STIX 2.1 and drops duplicates in Redis before they reach the rest of the pipeline.
Designed a 7-agent event-driven pipeline on Celery and Redis Streams (ingestion, enrichment, correlation, ATT&CK mapping, threat narrative, feedback learning and an orchestrator), so each stage scales, retries and replays on its own.
Scored every indicator by querying VirusTotal, OTX, Shodan, URLhaus, MalwareBazaar and CIRCL CVE in parallel into one weighted confidence score that decays with a 14-day half-life, so stale intelligence retires itself.
Clustered indicators into campaigns with 384-dimension sentence embeddings in Qdrant (merged above 0.55 cosine similarity) and linked their infrastructure in a Neo4j graph.
Mapped campaigns to MITRE ATT&CK v15 with Groq-hosted LLaMA 3.1 and a self-critique pass that prunes weak techniques; mappings under 0.65 confidence go to a human review queue instead of the database.
Built a self-validating prediction loop: ARGUS forecasts each campaign's next kill-chain phase, checks it against the intelligence of the next 30 days, and tunes its thresholds and rewrites its own prompts when its precision drops.
Shipped executive and technical threat reports as PDFs with generated Sigma detection rules, a FastAPI backend with a live WebSocket feed and three tiers of authentication, and a React dashboard (live feed, campaigns, ATT&CK heatmap, graph viewer, review queue, agent health).
Containerised the 11 services with Docker Compose (Prometheus and Grafana for monitoring) and deployed it as a public community platform (crowd review, API keys, an accuracy leaderboard) on zero-cost infrastructure: Render, Vercel, Neon, Upstash and Neo4j AuraDB.

Problem

A security operations centre receives tens of thousands of indicators of compromise a day, most of them duplicated, stale or noisy. Analysts paste each one into VirusTotal, OTX and Shodan by hand, see them as isolated data points rather than campaigns, map behaviour to MITRE ATT&CK from memory, and only ever learn what an attacker has already done.

Solution

ARGUS turns that work into an autonomous pipeline of seven agents connected by Redis Streams. Indicators are ingested, normalised and deduplicated, enriched and scored across six intelligence services, clustered into campaigns by vector similarity and graph relations, mapped to ATT&CK by a large language model that critiques its own answers, and written up as reports with detection rules. Each campaign also gets a forecast of the attacker's next phase, which ARGUS later checks against what actually happens and uses to correct itself.

Results

ARGUS runs as a public platform anyone can open, with its own API keys, a human review queue and a leaderboard of how accurate its predictions turn out to be, on infrastructure that costs nothing to run. The whole architecture, from the data contracts between agents to the dashboard, is documented in a public technical manual.

Case study

How an indicator becomes intelligence

Ingestion. The IngestorAgent polls seven open threat feeds every 60 seconds, parses each format into a STIX 2.1 indicator and checks a Redis key-space hash, so a duplicate is dropped in under a millisecond, before any API is called.
Enrichment and scoring. The EnrichmentAgent queries VirusTotal, OTX, Shodan, URLhaus, MalwareBazaar and CIRCL CVE in parallel, inside a shared rate-limit budget, and geolocates IP addresses. Their answers become one confidence score: VirusTotal weighs 0.35, OTX 0.25, MalwareBazaar 0.20, Shodan and URLhaus 0.10 and the feed's own reputation 0.10. The score then halves every 14 days, and an indicator below 0.20 is retired.
Correlation. The CorrelationAgent embeds each indicator with all-MiniLM-L6-v2 (384 dimensions) and searches Qdrant for its neighbours. Above 0.55 cosine similarity it joins an existing campaign, otherwise it starts a new one, and the link is written to PostgreSQL, Qdrant and a Neo4j graph of the campaign's infrastructure.
ATT&CK mapping. The MITREMappingAgent sends the campaign's context and the ATT&CK v15 reference to LLaMA 3.1 on Groq (or a local Ollama model), asks for structured JSON, then sends the answer back for a self-critique that removes techniques built on weak evidence. Anything under 0.65 confidence waits for a human in the review queue.
Narrative and prediction. The ThreatNarrativeAgent reads the campaign's timeline from Neo4j and writes an executive summary, a technical deep dive, mitigations, Sigma rules and a forecast of the attacker's next kill-chain phase.
Self-validation. The PredictionValidator watches the next 30 days of intelligence: a forecast that comes true is marked a true positive, one that does not a false positive. The FeedbackLearningAgent turns these into precision, tightens thresholds and adjusts its prompts when precision falls, and publishes the results on the leaderboard.

Engineering choices

Agents over a monolith. Each stage is a Celery agent reading one Redis stream and writing the next, with heartbeats to an orchestrator that watches stream depths, feed failures and the LLM token budget.
Standards first. Indicators are STIX 2.1 objects and behaviour is expressed in MITRE ATT&CK, so ARGUS's output can feed any SIEM or intelligence platform.
Honest about uncertainty. Every indicator, mapping and prediction carries a confidence, low-confidence mappings go to people, and the system measures how often its own forecasts are right.
Built to run anywhere. The full stack is one Docker Compose file, with overrides for low-memory hosts, production (closed database ports, no reload) and TLS, and Prometheus metrics for every agent.