Servers
Windows and Linux events (logins, users, processes) with the Argunis agent, plus IBM i.
Argunis/Security/SIEM
Every security event, explained.
Argunis gathers events from your servers, firewalls, clouds and identities, matches them against rules updated every week and maps them to MITRE ATT&CK, NIST and PCI DSS.
SIEMT1110 · T1078
Events today31.452
Detections · 24 h47
Open cases6
SLA breached1
Events per hour
Most attacked assets · 7 days
srv-bastion412
fw-borde268
vpn-sucursal191
web-tienda88
Where from · 24 h
Chile61 %
United States17 %
Netherlands9 %
Russia7 %
China6 %
Detections you can understand
Each detection tells you why it fired, which severity level from 1 to 15 it landed on and why, and which ATT&CK technique and standard controls it touches. Repeats are grouped into a single row.
- Severity 1 to 15 with per-company bands
- Adjusted by asset criticality
- Verdict, case, dismissal or exception
- Cerebro priority based on your history
CriticalSigma · Argunis
SSH brute force followed by successful login
Level13 / 15
Times214
ATT&CK · NIST · PCIT1110T1078NIST AC-7CSF PR.AA-03PCI 8.3.4
Entitiesuser · rootip · 203.0.113.47host · srv-bastion
Why did it fire?
214 failed logins from the same IP in 10 min, then a successful root login.
Why this severity?
High base + critical asset (exposed bastion) = critical.
Known false positives
Authorized scanners from your own company.
Create caseVerdictException
Cases with the steps to respond
High and critical detections open a case with an owner, resolver group and SLA. Playbooks bring the steps to contain and recover, and everything lands on the timeline.
- Take, reassign and investigate
- Step-by-step response recommendations
- Mark as contained and close with a verdict
- Cases never close on their own
SEC-0312 · srv-bastionSLA 00:42:10
InvestigatingOwner: Carla RojasGroup: Security
Response recommendations- ✓Review root logins on srv-bastionDone
- ✓Block 203.0.113.47 on the firewallDone
- Rotate the bastion’s SSH keys
- Review new processes and connections
- Critical detection · case opened14:02
- Taken by Carla Rojas14:05
- Step 2 done · IP blocked14:11
ATT&CK, NIST and PCI, control by control
Every rule is linked to its MITRE ATT&CK techniques and to the exact controls of NIST 800-53 Rev. 5, NIST CSF 2.0 and PCI DSS 4.0.1. See what you cover of each standard, what fired and where the gaps are.
- MITRE ATT&CK matrix with this week’s detections
- Coverage per standard and per control
- Custom rules with a form and time filter
- Observation mode and retroactive search
MITRE ATT&CK coverage186 techniques with active rules · 47 detections in 7 days
Initial Access
Execution
Persistence
Priv. Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Exfiltration
Impact
- No rules
- Rules off
- Active rules
- Detections · 7 d
Coverage per standard
MITRE ATT&CK74 %
NIST 800-53 Rev. 561 %
NIST CSF 2.068 %
PCI DSS 4.0.157 %
Rules and vulnerabilities that update themselves
Every week a signed package is built with SigmaHQ and Argunis rules, the standards, the vulnerability database and advisories for languages and firmware. It reaches every installation, on-premise included.
- New content runs in observation for 7 days
- Never overrides what your company tuned
- Roll back to the previous version
- Signed and verified before it applies
Rules and vulnerabilities package✓ Signed and verified
sigma r2026-10-27 · argunis · avisos 2026-10-27Mondays 05:00 · every week
- SigmaHQ rules
- Argunis rules
- NIST and PCI standards
- Vulnerability database
- Language and firmware advisories
SigmaHQOSV · DebianOSV · UbuntuOSV · AlpineOSV · Red HatOSV · RockyOSV · AlmaOSV · SUSEMicrosoft MSRCNVDCISA KEVFIRST EPSS
Applied to your company
1.733 new in observation · 7 days89 your tuning kept
↺ Roll backVulnerabilities from your inventory
The agent sends installed packages and, on Windows, KB patches. Argunis matches them against the package database and tells you what is vulnerable, which version fixes it and what is exploited today.
- Debian, Ubuntu, Alpine, Red Hat, Rocky, Alma and SUSE
- Windows by build and Microsoft KB
- Node.js, Python, PHP, Java, .NET and OpenSSL
- Firmware for FortiOS, PAN-OS, Cisco, Junos, RouterOS and more
Agent inventory · srv-erp-01Ubuntu 22.04 · 1,284 packages
PackageInstalledFixed inAdvisory
openssh-server1:8.9p1-3ubuntu0.61:8.9p1-3ubuntu0.10USN-6859-1
sudo1.9.9-1ubuntu2.31.9.9-1ubuntu2.4USN-6440-1
openssl3.0.2-0ubuntu1.123.0.2-0ubuntu1.15USN-6663-1
Windows Server 2022 · build 20348
Exploited today · KEVKB5044281 · Missing patchCVE-2024-43573
Evidence that stands up to an audit
Every batch of events is chained and every backed-up day carries a signed manifest. The evidence report gathers what an ISO/IEC 27001 auditor and Chile’s Law 21.663 ask for.
- Day-by-day verifiable integrity
- Emails and national IDs redacted before storage
- Restore past days
- Retention and backup per your plan
Chained batches · Nov 1Intact
✓Signed daily manifest
Evidence report · October
✓A.8.15 Logging
✓A.8.16 Monitoring activities
✓Law 21.663 · incident management
Source coverage97 % hours with events
Everything the SIEM includes
Firewalls and networks
FortiGate, Palo Alto, Cisco, Check Point, SonicWall, Sophos, pfSense, OPNsense and MikroTik via syslog.
Clouds and identities
Microsoft 365, Entra and Defender, AWS with GuardDuty and Security Hub, Google Cloud, Workspace, Okta and Kubernetes.
Development and platforms
GitHub, Bitbucket, Docker Hub, Cloudflare, Coolify, Railway and Wazuh.
Web servers
Nginx, Apache and IIS with the agent or via syslog, to detect attacks on your applications.
Event explorer
Search every event with facets, source country and the reputation of each IP, looked up locally.
Indicators and lists
Your own IOCs and lists of IPs, networks and domains, plus public reputation lists.
Expiring exceptions
Silence a known case for a while without turning the rule off for everyone.
Playbooks
Response recipes from Argunis or your own, with commands and the console to use.
Sources
New ones appear on their own: you include or ignore them, and you get warned when one goes silent.
Personal data
Emails and national IDs redacted; the original stays encrypted and only an admin can see it, with audit.
Evidence reports
Controls, source coverage, volume, integrity, detections and cases for the period, as PDF.
Argunis detects and recommends. Containment (blocking an IP, disabling an account) is done by your team with its own tools, and the case records who did it and when.
VulnerabilitiesFrequently asked questions
What do I need to start receiving events?
Enable the SIEM in your plan. Argunis agents send their security events and inventory, cloud integrations connect with their credential and firewalls send syslog to a monitoring probe.
How often are rules and vulnerabilities updated?
A signed package is built every week. New content runs in observation for 7 days before alerting, never overrides your tuning and you can roll back to the previous version.
Which standards does it cover?
MITRE ATT&CK, NIST 800-53 Rev. 5, NIST CSF 2.0 and PCI DSS 4.0.1, by exact control, plus the evidence report for ISO/IEC 27001.
Can I use my own rules?
Yes, with a form or in Sigma format, with severity, resolver group and time filter. Test them against the last 24 hours and keep them in observation before enabling them.
Are my IPs sent to external services?
No. Geolocation and reputation are looked up locally, with up-to-date public lists.
See the failure before your customers do.
We show you Argunis on your own operations and answer your questions in one call.