Argus Sentinelsource acquisition roomRequest files

Private sale / On-prem NDR

Argus Sentinel

A working Python network detection codebase for buyers who want a fast, inspectable security product foundation instead of a slide deck.

pytest
355 passed
CLI, ingest, web, detection, reports, integrations
runtime
Python 3.10+
SQLite WAL, Docker deploy, Suricata EVE reader
handover
source + docs
clean archive, transfer notes, short setup call
live product snapshot
read-only
18,430
events
89
alerts
7,812
flows
30d
retention

traffic / alerts

24h sample

protocol mix

SEV 1
Feodo match
10.0.0.42 -> 185.220.101.5
T1071
SEV 1
Upload anomaly
10.0.0.18 -> 45.9.148.20
9.4x outbound
SEV 2
DNS tunnel shape
10.0.0.77 -> resolver.local
entropy spike
SEV 2
SSH sweep
10.0.0.91 -> 10.0.0.0/24
41 hosts

product surface

Looks like a tool because it is one.

The public demo is intentionally read-only. The value being sold is the source package: detections, CLI, local console, report generation, deployment files and handover notes.

argus_sentinel/engine
01

Suricata EVE ingestion and packet/log pipeline

argus_sentinel/analytics
02

behavior scoring, beaconing, DNS and exfiltration signals

argus_sentinel/intel
03

feed loading, IOC matching and enrichment

argus_sentinel/web
04

local SOC console and JSON API

argus_sentinel/report
05

HTML/PDF/JSON evidence packages

deploy/
06

Docker Compose and service deployment material

source inspection
v0.1.0 package
argus_sentinel/
main.py
tests/
deploy/
licensing/
$ python main.py serve --eve /logs/eve.json --db /data/argus.db --detect
[argus] ingest=follow  web=:8080  retention=30d  intel=enabled
[detect] beaconing=on dns_tunnel=on exfil=on protocol_mismatch=on
argus_sentinel/engine
Suricata EVE ingestion and packet/log pipeline
argus_sentinel/analytics
behavior scoring, beaconing, DNS and exfiltration signals
argus_sentinel/intel
feed loading, IOC matching and enrichment
argus_sentinel/web
local SOC console and JSON API

buyer notes

Best sold as a clean source transfer, not a hosted subscription.

Keep the ask simple: full source, non-exclusive or exclusive license, setup walkthrough, and a fixed support window.

Replace demo defaults before production resale
Pin dependency set for buyer reproducibility
Ship clean package without private keys or local databases

actual repo evidence

Real command output, not a brochure claim.

These checks were run against the current source package during preparation of this demo. The numbers are intentionally small because the public page uses the bundled fixture, not a live customer network.

Fixture ingest
$ python main.py ingest --eve tests\fixtures\eve_sample.json --db demo-evidence.db
[argus] done: events=10 alerts=2 skipped=2 batches=1
Stats check
$ python main.py stats --db demo-evidence.db
alert 2 / dns 2 / flow 2 / anomaly 1 / http 1 / tls 1 / TOTAL 10
Regression suite
$ python -m pytest -q
355 passed

clean buyer package

What should be in the transfer folder.

Included
source tree, tests, Docker files, runbooks, compliance notes
Removed
local databases, generated private keys, installed license files
Transfer
repository archive, setup walkthrough, buyer license terms
Support
short fixed handover window for install and orientation

known limitations

No mystery box.

Docker compose defaults should be hardened before exposing a buyer pilot to the internet.
Dependency versions should be pinned for a clean reproducible handoff.
Internal network scope should be configured per buyer environment, not assumed from RFC1918 only.
The CLI is still concentrated in one large file; acceptable for transfer, but worth splitting in a later owner roadmap.

fast-sale positioning

Price the handoff, not the dream.

For urgent liquidity, the strongest angle is a practical buyer: a small MSSP, cyber lab, freelancer, training business or founder who wants a head start with working code.

suggested range

$1.5k-$3.5k

Faster sale: non-exclusive license. Better price: exclusive transfer with clean docs, demo access and a short support window.

support@argussentinel.com