Argus – Securing every angle

🛡️ AI-Powered Autonomous Security Agent for AWS

Comprehensive security monitoring, threat intelligence correlation, and automated incident response

---

📋 Overview

Argus is an autonomous security agent built on Amazon Bedrock that provides comprehensive security monitoring and incident response for AWS environments. Named after the many-eyed giant of Greek mythology, Argus watches your AWS infrastructure from every angle, correlating security findings with external threat intelligence and providing actionable remediation guidance.

Key Features

• 🤖 AI-Powered Analysis: Leverages Claude 3 models via Amazon Bedrock for intelligent security analysis
• 🔍 Multi-Source Intelligence: Correlates GuardDuty, Security Hub, CloudTrail, and VPC Flow Logs
• 🌐 Threat Intelligence: Integrates external TI feeds for IOC matching and threat attribution
• ⚡ Real-time Monitoring: Continuous security posture assessment with automated alerting
• 🎯 Targeted Response: Provides specific remediation steps and playbook execution
• 📊 Interactive Dashboard: Streamlit-based interface for security analysts
• 🔧 Automated Actions: Direct AWS API integration for rapid response

---

---

🏗️ Architecture

graph TB
    A[Security Events] --> B[Lambda Functions]
    B --> C[DynamoDB Storage]
    C --> D[Bedrock Agent]
    E[Threat Intel Feeds] --> D
    D --> F[Knowledge Base]
    F --> G[Security Analyst]
    G --> H[Streamlit Dashboard]
    D --> I[Automated Remediation]

Loading

Components

• Lambda Functions: Event processing and action execution
• DynamoDB: Security findings and threat intelligence storage
• Amazon Bedrock: AI agent orchestration and natural language processing
• Knowledge Base: Threat intelligence and playbook repository
• Streamlit Dashboard: Interactive security analyst interface

---

🚀 Quick Start

Prerequisites

• AWS Account with administrative access
• AWS CLI configured with appropriate credentials
• Python 3.9+ and pip
• Terraform 1.6+
• Access to Amazon Bedrock (Claude models)

Installation

1. Clone the repository

   git clone https://github.com/enriqew/argus-agent.git
   cd argus-agent

2. Configure environment

   cp .env.example .env
   # Edit .env with your configuration values

3. Deploy infrastructure

   # Initialize Terraform
   cd infra
   terraform init
   terraform plan
   terraform apply
   
   # Note the output values for Lambda ARNs
   cd ..

4. Setup Bedrock Agent

   cd bedrock
   python bedrock_setup.py
   # Save the AGENT_ID and ALIAS_ID from the output
   cd ..

5. Configure Knowledge Base

   python setup_knowledge_bases.py

6. Load sample data

   # Load demo security findings and threat intelligence
   python -c "
   import boto3
   from lambdas.common.utils import load_sample_data
   load_sample_data()
   "

7. Launch dashboard

   cd streamlit_app
   pip install -r ../requirements.txt
   streamlit run app.py

---

⚙️ AWS Account Configuration

Step 1: Install AWS CLI

Windows:

# Download from: https://awscli.amazonaws.com/AWSCLIV2.msi
aws --version

macOS:

brew install awscli
aws --version

Linux:

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
aws --version

Step 2: Configure AWS Credentials

aws configure
# AWS Access Key ID: YOUR_ACCESS_KEY
# AWS Secret Access Key: YOUR_SECRET_KEY
# Default region: us-east-1
# Default output format: json

Step 3: Apply IAM Permissions

Create and attach the minimal required permissions:

# Create the policy file
cat > argus_minimal_policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "TerraformDeployment",
      "Effect": "Allow",
      "Action": [
        "s3:*",
        "dynamodb:*",
        "lambda:*",
        "iam:*",
        "events:*",
        "logs:*",
        "ec2:*",
        "bedrock:*"
      ],
      "Resource": "*"
    }
  ]
}
EOF

# Create and attach managed policy
export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
export AWS_USERNAME=$(aws iam get-user --query 'User.UserName' --output text)

aws iam create-policy \
  --policy-name ArgusMinimalAccessPolicy \
  --policy-document file://argus_minimal_policy.json

aws iam attach-user-policy \
  --user-name $AWS_USERNAME \
  --policy-arn "arn:aws:iam::${AWS_ACCOUNT_ID}:policy/ArgusMinimalAccessPolicy"

Step 4: Enable Bedrock Model Access

1. Go to Amazon Bedrock Console
2. Click Model access in the left sidebar
3. Click Request model access
4. Enable Claude 3 Haiku and Claude 3.5 Sonnet
5. Submit request and wait for approval (usually 2-5 minutes)

Step 5: Validate Setup

# Run comprehensive validation
chmod +x validate_aws_setup.sh
./validate_aws_setup.sh

---

🎯 Usage Examples

Security Posture Check

"Run a comprehensive security posture assessment of my AWS account"

Threat Hunting

"Hunt for exposed S3 buckets and overpermissive security groups"

Incident Investigation

"Investigate the recent GuardDuty finding about cryptocurrency mining activity"

Threat Intelligence Correlation

"Check if IP 185.220.100.240 appears in our logs and correlate with known threat intelligence"

Automated Remediation

"Quarantine EC2 instance i-1234567890abcdef0 and block its network access"

---

📁 Project Structure

argus-agent/
├── infra/                    # Terraform infrastructure
│   ├── main.tf              # Core AWS resources
│   ├── variables.tf          # Configuration variables
│   └── outputs.tf            # Resource outputs
├── lambdas/                  # Lambda functions
│   ├── argus_actions/        # Remediation actions
│   ├── ti_collector/         # Threat intelligence collection
│   └── common/               # Shared utilities
├── bedrock/                  # Bedrock agent configuration
│   ├── bedrock_setup.py      # Agent deployment script
│   ├── action_group_openapi.yaml  # API schema
│   └── system_instructions.txt    # Agent instructions
├── streamlit_app/            # Web dashboard
│   └── app.py               # Main dashboard application
├── datasets_sim/             # Sample security data
│   ├── guardduty_sim/       # Sample GuardDuty findings
│   ├── securityhub_sim/     # Sample Security Hub findings
│   ├── cloudtrail_sim/      # Sample CloudTrail events
│   ├── vpcflow_sim/         # Sample VPC Flow logs
│   └── ti_seed/             # Sample threat intelligence
├── docs/                     # Documentation
│   ├── runbook_quarantine_ec2.md
│   ├── runbook_s3_block_public.md
│   └── heuristics_scoring.md
├── .env.example             # Environment configuration template
├── .gitignore              # Git ignore patterns
├── requirements.txt        # Python dependencies
└── README.md              # This file

---

🔧 Configuration

Environment Variables

Copy .env.example to .env and configure:

# Bedrock Agent Configuration (required)
BEDROCK_AGENT_ID=your_agent_id_here
BEDROCK_ALIAS_ID=your_alias_id_here

# Optional Configuration
AWS_REGION=us-east-1
BEDROCK_AGENT_ROLE_NAME=BedrockAgentRole
BEDROCK_KB_ROLE_NAME=BedrockKnowledgeBaseRole

Terraform Variables

In infra/terraform.tfvars (optional):

project_name = "my-security-agent"
region       = "us-west-2"

---

🛡️ Security Features

Data Sources

• Amazon GuardDuty: Threat detection findings (real-time with fallback to sample data)
• AWS Security Hub: Centralized security findings (real-time with fallback to sample data)
• AWS CloudTrail: API activity monitoring (real-time with fallback to sample data)
• VPC Flow Logs: Network traffic analysis (real-time with fallback to sample data)
• External Threat Intelligence: IOC feeds and attribution data

Automated Actions

• EC2 instance quarantine and isolation
• S3 bucket public access blocking
• IAM access key rotation and deactivation
• Security group rule modification
• CloudTrail log analysis and alerting

Threat Intelligence

• Real-time IOC correlation
• Threat actor attribution
• Campaign tracking and analysis
• False positive reduction through contextual analysis

Smart Data Fallback

• Automatic Detection: Argus automatically detects if AWS security services are enabled
• Real-time Priority: Uses live GuardDuty, Security Hub, CloudTrail, and VPC Flow Logs when available
• Seamless Fallback: Falls back to sample data if services are not configured or accessible
• Transparent Operation: User experience remains consistent regardless of data source

---

📊 Dashboard Features

The Streamlit dashboard provides:

• Real-time Security Metrics: Active findings, incidents, exposed resources
• Interactive Chat Interface: Natural language queries to Argus
• Quick Action Buttons: Pre-configured security checks
• Threat Intelligence Panel: IOC matches and recommendations
• Security Posture Overview: Account-wide security status

---

🔍 Troubleshooting

Common Issues

"Access Denied" errors:

# Verify IAM policy attachment
aws iam list-attached-user-policies --user-name $AWS_USERNAME

"Invalid credentials":

# Reconfigure AWS CLI
aws configure
aws sts get-caller-identity

"Bedrock not available":

# Ensure correct region
aws configure set region us-east-1
# Request model access in Bedrock Console

Agent not responding:

# Check agent status
aws bedrock-agent get-agent --agent-id $BEDROCK_AGENT_ID
# Verify Lambda function deployment
aws lambda get-function --function-name argus-actions

---

💰 Cost Estimation

Expected monthly costs for typical usage:

• S3 Storage: ~$1-2 (datasets and logs)
• DynamoDB: ~$2-5 (on-demand pricing)
• Lambda: ~$1-3 (minimal execution time)
• Amazon Bedrock: ~$5-15 (depends on query volume)
• CloudWatch Logs: ~$1-2 (basic logging)

Total: ~$10-27/month for demo usage

Cost Optimization Tips

• Use DynamoDB on-demand pricing
• Enable S3 Intelligent Tiering
• Set up billing alerts (included in setup)
• Clean up resources when not needed

---

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

---

Argus – Securing every angle