Argus — SLAs and Asset Inventory for DFIR-IRIS
DFIR-IRIS tracks incidents well, but an asset only exists inside the case that mentions it and SLAs are not enforced on cases. Argus runs next to IRIS and fills both gaps: every case gets a live response and resolution countdown, and assets become a standalone inventory with owner, criticality and every case they appeared in. Asset criticality then feeds a risk score that ranks what to handle first.
// Architecture
Argus is not an IRIS fork or module: a thin open-source bridge (Apache-2.0) mirrors assets from IRIS over its REST API, opens an SLA when a case is created and writes breaches and risk scores back onto the IRIS case. The core is a FastAPI service on PostgreSQL with Alembic migrations, API-key auth on the REST API and a server-rendered operator console. It ships as Docker Compose, with an optional Caddy TLS stack for production.
// Key capabilities
Enforced SLAs
Per-severity policies, response and resolution countdowns on every case, and a breach state machine from on track to at risk to breached or met.
Cross-case asset inventory
Assets live outside the case with ownership, criticality, lifecycle, sightings and links, so a known server never arrives blank in its seventh case.
Risk-based priority
A risk score blends incident severity with the most critical asset involved, so an alert on a production database outranks one on a dev sandbox.
Results back inside IRIS
A background sweep raises one notification per new breach, and the breach and risk score are written onto the IRIS case where analysts already work.
// Technology stack
- Python / FastAPI
- PostgreSQL
- SQLAlchemy / Alembic
- DFIR-IRIS API
- Docker
// Inside the project
// Next step
Need something like Argus — SLAs and Asset Inventory for DFIR-IRIS?
Tell us what you're building. We'll reply with how we'd approach it, a rough timeline and the first step.
Start a similar project