Quickstart

This is the shortest path from an empty tenant to real findings on your own data. It mirrors the setup checklist Argus shows on your dashboard, so you can follow along in the product: the checklist advances on its own as each step completes and disappears when all three are done.

Sign in at app.argusdspm.com. Until setup finishes, the dashboard shows the checklist instead of its metrics, deliberately, because every counter would otherwise read zero and look like a posture claim rather than an empty state.

1. Connect a cloud account.

   Go to Accounts and add one. For AWS this asks only for a name, the 12-digit account ID, and a region. There is no role ARN and no access key, because the agent supplies its own credentials at runtime from inside your VPC. See Cloud Accounts.

2. Deploy the agent.

   Pick the shape that fits your environment: a one-click CloudFormation stack, Terraform, an ECS task, or a local container. Deploy the agent has a decision tree and a page per path. Read Pre-flight first.

   The checklist watches for the agent’s first heartbeat and advances the moment it lands, so you can leave the page open. If it does not, Verifying connection has the three signals to check.

3. Run discovery.

   From the account’s row action, choose Run discovery now, or run a full assessment to discover and scan in one pass. Discovery finds your datastores; scanning looks inside them.

   Your inventory appears almost immediately. Classification results, risk scores, and compliance posture appear as scans complete.

What to look at first

Once the first scan finishes, the dashboard fills in. In order of what actually tells you something:

1. Coverage, on the stat row. The share of your inventory that has been scanned. Every other number describes only that share, so read this first. A high score across low coverage is an untested posture, not a good one.
2. Top Risk Datastores, which is your triage list. Each row opens the datastore’s detail drawer.
3. Compliance Scorecard, sorted worst framework first. Check the Not Verified count before reacting to a score: it usually means a missing IAM read permission rather than a real failure, and it is the cheapest thing on the page to fix.

Common first-run surprises

Some datastores say Needs Credentials. RDS and Redshift need their own connection details before they can be scanned. Object stores do not. See Datastores.

Identity pages are empty. Identity data comes from IAM discovery, which is a separate sweep. Run it from Accounts or tick Include identity analysis on an assessment. If it stays empty, the agent role is probably missing the identity permissions in IAM permissions.

A control says Not Verified rather than passing or failing. Argus could not read the evidence, almost always a missing read permission. It is neither a pass nor a fail, and it is fixable in minutes.

Findings show a range rather than an exact count. Argus samples and extrapolates rather than reading every object, and reports an honest interval instead of false precision. See Sampling & extrapolation.

Next

• Core concepts at a glance - the vocabulary, in one screen.
• Navigating Argus - the layout every page shares.
• How Argus Works - the engines behind the numbers.