Resources
Everything you need to know in order to get started and be successful with ARGOS.
Registration
How do I sign up to ARGOS?
Signing up to ARGOS is done in three simple steps.
- Browse to https://app.argos-security.io
- Add your details
- Click sign-up
Does ARGOS support Single Sign On?
The following identities are supported by ARGOS:
- Azure Active Directory / Office 365
- Google / Gmail / GSuite
- Amazon
Team members must log in with valid email addresses.
Does ARGOS support Multi Factor Authentication?
If you have MFA configured on the user account you are logging in with, then ARGOS will also prompt you based on that configuration.
Deployment
What do I have to deploy to use ARGOS?
Almost nothing.
You'll only have to add an Azure Service Principal / Azure AD App Registration (for Azure), your AWS IAM role (for AWS) or GCP Service Account to ARGOS.
That's it. You do not need to deploy any infrastructure into your cloud environment to get the full benefits of running ARGOS.
How much does it cost me to run ARGOS?
Besides the subscription cost there is no other cost associated with ARGOS on Azure or GCP.
Be aware that the increase in API calls on AWS might have cost implications for your AWS CloudTrail service. Please reach out to support@argos-security.io to discuss this.
Note: Using ARGOS to remediate rule violations may have effects on resource cost.
Onboarding Cloud Environments
How do I onboard Azure?
ARGOS requires an Azure AD application to authenticate to a customer's Azure cloud. You can create one in a few simple steps:
Once that is created ARGOS requires at least Reader permissions to each Azure subscription you want to monitor.
Follow these steps to assign Reader permissions to the Azure AD application from above:
If you want to use ARGOS's remediation feature, then ARGOS also requires the appropriate "write" permissions to the Azure subscription.
How do I onboard AWS?
ARGOS requires an AWS IAM Role to be created in every AWS account you want ARGOS to monitor.
Follow these steps here to create a role:
In your "My Account" page you can find all required information to create the roles, including the ARGOS AWS Account ID and ExternalId for the IAM role's trust policy. The process behind these information is described in this AWS article.
The role requires access to at least the following IAM policies:
- ViewOnlyAccess
- SecurityAudit
Alternatively, check out the link here to find a very specific IAM policy already prepared for you with precisely the permissions required.
If remediation is used from within ARGOS then the IAM role needs access to make required changes. The policies in this case depend on the services being remediated.
In your "My Account" page you can now add an AWS account specifying the following information.
- AWS Account ID(s)
- AWS IAM Role name
- AWS regions to be monitored
How do I onboard GCP?
ARGOS requires a GCP Service Account to authenticate against an organisation's GCP projects.
Please follow these simple steps to create a GCP Service Account:
ARGOS will ask you to upload the Service Account key file that you can download following this process:
At a minimum ARGOS requires the Cloud Asset Viewer and Security Center Service Agent (Project) roles in order to execute the real time inventory and security scanning.
These permissions can be assigned at the Project and / or Folder level.
If you want to use ARGOS's remediation feature we will require you to grant ARGOS the appropriate "write" permissions.
In your "My Account" page you can now add the GCP Projects specifying above information.
Security
Where does ARGOS store my data?
When signing up to ARGOS customers have the choice of regions they want to have their data stored.
Currently ARGOS supports the following regions:
- Australia
- Europe (EU)
Is my data secure?
ARGOS encrypts sensitive data like the Azure, AWS or GCP credentials with AES-256 GCM in our database.
ARGOS does not store any customer passwords as every customer tenant is automatically enabled for SSO (Single Sign On).
What data does ARGOS store?
ARGOS does not store any application or user data from within your cloud environment.
ARGOS stores data of the following types:
- Cloud Resource IDs
- Cloud Resource Names
- Cloud Resource Configuration
- Cloud Resource Tags
ARGOS does not read any files or access any application data in your environment.
ARGOS does not store any Personal Identifiable Information (PII) nor credit card information.
For more information read our Privacy Policy
What happens to our data after we cancel our subscription?
Customer data is automatically marked for deletion 30 days after the end of the subscription.
Working with ARGOS
Can we ignore resources from ARGOS scan?
Can we ignore a detection?
Yes, specific detections can be ignored by an ARGOS user if they are expected on a resource.
Simply find the rule violation in question and click the "ignore" button.
A user can easily revert this by finding the ignored resource and selecting "unignore" at which point the resource will again be included in graphs and scoring.
Why can't I see any GCP info?
GCP requires their customers to enable API endpoints in order to have applications programmatically interact with GCP services.
Please check the following URL (https://console.cloud.google.com/apis) in each of your GCP projects and make sure that all APIs of services that are in use in your environment are enabled. Follow the GCP documentation in order to enable APIs in your GCP projects.
3rd Party Integrations
How do I send notifications to Slack?
ARGOS can send notifications of new detections into a customer-owned Slack channel.
All we require a webhook to this channel. A Slack incoming webhook can be created by clicking the "Add to Slack" button on https://app.argos-security.io/account/notifications
How do I send notifications to Microsoft Teams?
ARGOS can send notifications of new detections into a customer-owned Teams channel.
All we require is the webhook URI to this channel. A Teams incoming webhook can be created by following this process here.
Add the webhook URI to the "Notifications" tab on https://app.argos-security.io/account/notifications .
How do I create issues in Atlassian Jira?
ARGOS can easily create Jira tickets in order to assign detections to the right members of your team.
- browse to https://app.argos-security.io/account/jira
- Add your JIRA user account's email address
- Create a JIRA API token at https://id.atlassian.com/manage-profile/security/api-tokens.
- Provide the URI to your JIRA workspace in the format "https://yourworkspace.atlassian.net/"
- Select the default project to connect ARGOS to
- Select the issue type you want ARGOS to create when exporting
Once configured, a new button will appear when browsing to any detection. Test it out by browsing to https://app.argos-security.io/detections and select any detection. You will now see the "Export to Jira" button.
How do I create issues in Service Now?
ARGOS can easily create Service Now tickets in order to assign detections to the right members of your team.
- browse to https://app.argos-security.io/account/service-now
- Add your Service Now instance name.
- Add a user name and password of a Service Now user with permissions to create incidents in Service Now.
Once configured, a new button will appear when browsing to any detection. Test it out by browsing to https://app.argos-security.io/detections and select any detection. You will now see the "Export to Service Now" button.
How do I send events to Microsoft Sentinel?
ARGOS can send data about detections to your Microsoft Sentinel workspace.
In order to configure this integration follow these simple steps:
- Browse to https://app.argos-security.io/account/sentinel
- Paste the Sentinel Workspace ID and Sentinel Primary Key into the dialogue.
New detections will automatically be sent to Sentinel and can be queried from the "ARGOS_CL" table.