About Argus
A portfolio project by adiikj. It’s a working security event pipeline, deployed on a small VM and running against real internet traffic.
How it’s built
- Ingestion
- Synthetic auth, nginx and API logs, plus real probe traffic from the live server.
- Parsing
- Three formats into one Zod-validated event, with an id that traces it end to end.
- Detection
- 15 rules: signatures, sliding windows and per-source baselines.
- Correlation
- Throttled alerts grouped into one incident per source, stored in Postgres.
- Enrichment
- GeoIP from DB-IP, reputation from AbuseIPDB, then an LLM summary.
- Delivery
- CI builds and scans the images. The server only pulls them.
Decisions worth asking about
Isolated rule state
Each rule gets its own key namespace, so two rules keyed by the same IP can’t read each other’s counts.
Proxies trusted by address
Rate limits key on the real client IP, and a forged X-Forwarded-For can’t change it.
Visitors stay out
Only requests for paths the api doesn’t serve are ingested, so dashboard users never show up as attackers.
Optional integrations
Every external service is optional. With no keys at all, Argus still runs end to end.
Stack
TypeScript · Node 24 · Fastify · Kafka · PostgreSQL · Prisma · Redis · Next.js · WebSockets · Zod · Docker · GitHub Actions