Deploy and operate the DOCA Argus runtime-security container on BlueField with SIEM forwarding.
npx skills add https://github.com/NVIDIA/skills --skill doca-argus
Please help me install this Agent Skill. Skill: doca-argus Source: https://github.com/NVIDIA/skills/tree/main/skills/doca-argus Command: npx skills add https://github.com/NVIDIA/skills --skill doca-argus
Security operators deploying runtime threat detection on NVIDIA BlueField DPUs often misconfigure the DOCA Argus container, leaving SIEM channels silently empty, flooding them with false positives, or creating undocumented blind spots. This Skill guides agents through correct Argus deployment, configuration, calibration, and debugging so findings reliably reach the security operations team.
Ask your agent to help deploy the DOCA Argus container on a BlueField-3 and forward its security findings to your Splunk instance.
High-intent search queries and answers about installing and using this skill.
Pull the Argus container image from NGC at the tag the public DOCA Argus Service Guide names for your DOCA release, mount your config file at the documented path, and start it via the BlueField container manager per the Container Deployment Guide. Decide detection policy, forwarding, sampling, and host coverage first.
Use Argus for production runtime security as a packaged workflow with SIEM integration; it is NVIDIA's currently-promoted framework. Choose the App Shield library only when building custom DPU-side security tooling with your own detection logic, which is not covered by this Skill.
This is typically a forwarding-layer problem, not a detection-policy problem. Check the forwarder configuration, network reachability from the BlueField to the SIEM endpoint, and authentication material, then confirm the forwarder handshake line in the container logs.
Yes, Argus pairs with Splunk, ELK, Sentinel, and generic syslog destinations through its documented forwarder. Argus emits findings in the documented format; the SIEM-side ingest configuration is owned by your SIEM team's own documentation.
Treat early false positives as an expected calibration-period phase, not a bug. Tune the detection policy per the public guide or raise the sampling threshold; never silently disable a detector class without documenting and time-boxing the change.
Skip Argus when there is no security-posture concern, since it carries container, sampling CPU, and SIEM channel costs. Also route elsewhere for metrics observability (use DOCA Telemetry Service) or for building custom DPU-side security tools (use the App Shield library).
Nerfherder16Diagnose Docker host and container health with Docker CLI access.
AgentSecOpsCreate, validate, and translate Sigma rules for Splunk, Elasticsearch, and Sentinel backends.
air-gappedAutomate NVIDIA datacenter GPU bring-up on Ubuntu 24.04 with health validation.
Forexgod21Validate instruction source authority across a four-level gradient before execution.
