Glossary
Terms are grouped by area. Where two words sound like synonyms but mean different things in Argus, the distinction is spelled out, because those are the pairs that cause real mistakes.
Core objects
Section titled “Core objects”Tenant - the isolation boundary. Every datastore, identity, alert, policy, agent, and audit record belongs to exactly one, and there is no cross-tenant view in the product.
Datastore - any store Argus inventories: an S3 bucket, RDS instance, DynamoDB table, Redshift cluster, Azure Blob container.
Identity - an IAM principal: a user, role, group, or service identity.
Agent - the container you deploy into your own cloud that performs discovery and scanning. It processes data in place and sends back only structured findings.
Cloud account - a connected AWS account or Azure subscription. The unit schedules, jobs, and inventory are organised around.
Job - one unit of agent work, either a discovery or a scan.
Discovery and scanning
Section titled “Discovery and scanning”Discovery - finding which datastores exist. It does not look inside them.
Scanning - looking inside a discovered datastore to classify its contents.
A datastore is always discovered first and scanned second, which is why a freshly connected account shows an inventory almost immediately but no findings until the first scan completes.
Assessment - a one-shot run over a whole cloud account: discovery, then optionally scanning, and optionally identity analysis.
Incremental scan - re-checks only new and changed objects, trusting the cache for the rest.
Force re-scan - bypasses that cache and re-reads everything. Only object stores have a cache to bypass.
Scan intensity - low, medium, or high. Trades coverage against time and cost.
Not Found - a resource that was present before and is absent from the latest discovery run. Distinct from deleted: Argus keeps the record so history survives and reappearance works.
Grace window - the 24 hours a Not Found resource is left alone before its alerts and violations are dismissed, guarding against a transient discovery blip.
Classification
Section titled “Classification”Finding - one detection of sensitive data.
Category - the top-level grouping of sensitive data: PII, financial, health, credentials, API keys, intellectual property, legal.
Data type - the specific thing detected within a category, such as a card number or a national identifier.
Detection confidence vs statistical confidence - two different questions, and conflating them is a common error. Detection confidence is how sure we are this match is real, backed by checksums and context. Statistical confidence is how sure we are the extrapolation from a sample represents the whole store. A confirmed card number in a thin sample has high detection confidence and low statistical confidence. See Confidence scoring.
Extrapolation - estimating totals for a datastore from a sample, reported as a range rather than a false-precision number.
Coverage - the share of your estate that has actually been scanned. The honesty check on every other number.
Risk score - 0 to 100 per datastore, from content sensitivity, volume, exposure, and detection confidence, adjusted by reachability, compliance pressure, datastore type, and trend.
Risk band - the label on that score: Critical, High, Medium, Low, Minimal.
Exposure - whether the data is reachable. The heaviest single input to risk.
Unverified - Argus could not confirm a signal, usually a missing IAM read permission. Argus assumes the worse case and flags it, rather than scoring a blind spot as safe.
Reachability - who and what can actually get to the data: public access, stale grants, cross-account access, over-privileged identities.
Blast radius - what one identity would reach if compromised.
Toxic combination - several individually tolerable conditions that are dangerous together. It is why an alert can be critical when no single finding looks critical.
Identity
Section titled “Identity”Over-privileged - granted materially more than the identity actually uses, evidenced by permission utilization rather than asserted.
Permission utilization - services granted versus services actually used, from AWS Access Advisor.
Stale - no recent activity.
Access grant - one parsed permission: a principal, a resource, an effect, and actions.
Governance concern - a grant flagged for human review: dormant privileged, wildcard actions, admin access, cross-account, write access, dormant.
Credential hygiene - signals about how an identity’s credentials are kept: multiple active keys, unused keys, stale passwords, missing MFA.
Findings and response
Section titled “Findings and response”Alert - something wrong that wants attention now.
Policy violation - a breach of a rule you wrote.
Compliance control - a requirement from a framework Argus ships with.
One condition can produce all three at once. They are not duplicates: an alert is urgency, a violation is your standard, a control is an external obligation.
Incident - several related alerts grouped into one investigation with a priority, an owner, and SLA clocks.
Recommendation - a specific fix, grouped by fix rather than by resource, with a projected risk reduction.
Remediation - actually changing your cloud to remove a root cause.
Mitigation - a compensating control that limits damage while the finding persists. Deliberately never presented as a fix.
Suppress vs Waive vs Resolve vs Dismiss
Section titled “Suppress vs Waive vs Resolve vs Dismiss”Four words for “make it go away” that mean four different things:
| Term | Applies to | Meaning |
|---|---|---|
| Suppress | Alerts | You hide it from view. It keeps being evaluated |
| Waive | Violations | You accept it, with a reason and usually an expiry |
| Resolve | Both | The condition is genuinely gone. System-set for alerts; for violations it is a claim the next scan will re-check |
| Dismiss | Both | The underlying resource no longer exists. Always system-set |
The pairing is not interchangeable: alerts are suppressed, violations are waived.
Take Over - claim a violation as yours to work. Not an acceptance of risk.
Lift Waiver - return a waived violation to active work. The only action available on a waived violation.
Remediation mechanics
Section titled “Remediation mechanics”Workflow - a named fix: target, trigger, steps, and safety controls.
Execution (a run) - one attempt at applying a workflow.
Dry run - reports what would change without changing it.
Run mode - Manual, Semi-auto (triggered but approval-gated), or Auto (fires without approval, admin only).
Approval gate - the requirement that a human authorises a run before it executes.
Rollback - a verified reversal of a completed run, available for a limited window.
Rollback window - 24 hours after a successful live run, after which cloud state may have drifted too far for a reversal to be meaningful.
Halt on failure - cancel the rest of a batch when one execution fails.
Max resources per run - the blast-radius cap on a single batch.
Compliance
Section titled “Compliance”Framework - a regulation or standard: GDPR, HIPAA, PCI DSS, SOX, CCPA, ISO 27001, SOC 2, GLBA.
Control - one requirement inside a framework.
Not Verified - a control that could not be checked, almost always a missing IAM read permission. Neither a pass nor a fail, and the fastest score improvement available to most tenants.
Gap - an applicable control that is failing.
Readiness - how far along you are toward a framework, splitting addressed, needs-verification, and active gaps.
Estimated exposure - a monetary estimate from published penalty ranges, for ranking gaps against each other. Not legal advice.
Platform and access
Section titled “Platform and access”Role - a named bundle of permissions. Six ship built in and cannot be edited.
Permission - a resource:action string such as datastores:scan.
View permission - a permission that controls whether a page and its nav item appear at all, which is why colleagues see different sidebars.
Tenant owner - the single account with full authority in a tenant. Established at setup, not a role, and not transferable from inside the product.
Team - a group of users that can own alerts, incidents, policies, and violations, so work survives someone’s absence.
Enrollment token - the one-time credential an agent exchanges at first boot for its own API key. Belongs to a cloud account.
Agent API key - the per-agent credential used after enrollment. Rotatable, with a grace window so rotation is not an outage.
Agent operations
Section titled “Agent operations”Heartbeat - the periodic signal an agent sends to show it is alive.
Stalled - heartbeating but not claiming work. Functionally down while appearing online, and the most important agent status to recognise.
Baseline vs burst - always-on agents versus ones that scale up under load and recede afterwards.
Version lag - running behind the recommended or minimum supported agent version.
Reaping - the platform marking an abandoned or unclaimable job as failed with a reason, rather than leaving it stuck.