Navigating Argus
Argus is organised around the loop a security team actually works: find out what you have, find out what is wrong with it, fix it, then prove it. The sidebar follows that order, and almost every page is built from the same three pieces: a summary row, a filterable table, and a detail drawer. Learn those once and every area of the product reads the same way.
The sidebar
Section titled “The sidebar”The left rail groups pages by what you are trying to do, not by which backend service owns them:
| Group | Pages | What it answers |
|---|---|---|
| (top) | Dashboard | Where does my posture stand today? |
| Inventory | Datastores, Identity | What do I have, and who can reach it? |
| Detect | Alerts, Risk, Violations | What is wrong right now? |
| Respond | Recommendations, Remediation | What should I do, and can Argus do it? |
| Govern | Policies, Compliance, Reports | What are my rules, and can I prove I meet them? |
| Infrastructure | Accounts, Agents | Is the data pipeline itself healthy? |
| Admin | Users, Audit Log, Settings | Who has access, and what changed? |
Two details worth knowing:
- Policies and Violations are the same page. The policy library lives under Govern (because writing rules is a governance act) and the violations it produces live under Detect (because findings are triage work). Both render the Policies page on different tabs.
- The Alerts item carries a live count badge of open alerts, refreshed about once a minute. It is the only nav item with a badge.
Group headers collapse, and the whole rail collapses to icons with the tab on its right edge. Both preferences persist across sessions in your browser.
On phones and small tablets the rail becomes a bottom bar with four fixed destinations (Dashboard, Alerts, Datastores, Remediation) plus More, which opens the full navigation drawer. The four are fixed deliberately, so reordering the desktop sidebar never silently changes what mobile users get.
The top bar
Section titled “The top bar”The same controls sit on every page, on the right of the header strip:
- Search (or
Cmd/Ctrl + K). A cross-object search: type two or more characters and it returns matching datastores, alerts, incidents, cloud accounts, users, agents, and identities, grouped by kind. Arrow keys move, Enter opens the item directly in its detail view rather than dropping you on a list to hunt through. - Theme toggle. Light and dark are both first-class; nothing is dark-mode-only.
- AI assistant. Only present when the assistant is enabled for your account.
- Notifications. In-app notifications, with a link through to the full panel.
- Assessment progress. A ring appears here while an account assessment is running, showing percent complete, datastores discovered, job counts, and an estimate of time remaining. It turns into a summary card when the run finishes (datastores found, total size, high-risk count, public count) and offers a cancel action while it is still going.
Your profile and sign-out live at the bottom of the sidebar under My Account.
The shape of a page
Section titled “The shape of a page”Nearly every area follows the same anatomy:
- Page header with the title, a one-line subtitle, and the page-level actions (for example Add Account, Discover Datastores, a refresh button, a time-range selector).
- Summary cards. A row of counts or scores that describe the filtered set below them.
- Tabs, where an area has more than one view. Tabs are stored in the URL as
?tab=, so a tab is linkable and survives a refresh or a browser back. - Toolbar: free-text search, filter chips, and a CSV export where the data supports it. Filters are multi-select and stack; the summary cards above recalculate against whatever is left. Nothing is exported that is not on screen, so an export always matches the filters you can see.
- Table, sortable by column, paginated, with row selection driving a bulk-actions bar where bulk operations exist.
- Detail drawer, opened by clicking a row. Drawers slide in from the right, keep the list behind them, and are organised into collapsible sections that open by default only when they have something worth your attention (for example the Compliance section on a datastore opens if a control is failing).
Because the list stays mounted behind the drawer, the intended workflow is to work a filtered list top to bottom without losing your place.
Deep links
Section titled “Deep links”Every detail view is addressable, which is what makes cross-linking between areas work. Argus uses these internally and you can use them too, in bookmarks, runbooks, or ticket links:
| Link | Opens |
|---|---|
/datastores?datastoreId=<id> |
The datastore detail drawer |
/security?alertId=<id> |
The alert detail drawer |
/security?incidentId=<id> |
The incident detail |
/accounts?accountId=<id> |
The cloud account |
/identity?selected=<id> |
The identity detail drawer |
/policies?tab=violations&status=open |
Open policy violations |
/policies?policyId=<id> |
A policy detail |
/remediation?executionId=<id> |
A remediation execution |
/compliance?framework=<name> |
One framework’s controls |
/agents?tab=jobs&jobId=<id> |
One scan or discovery job |
This is why, for example, the alerts listed inside a datastore drawer are clickable: they hand you to the alert’s own drawer rather than duplicating a thin summary.
Tenant context
Section titled “Tenant context”Everything you see belongs to one tenant. Datastores, alerts, policies, agents, and audit records are scoped to it, and there is no cross-tenant view in the product. Your role within that tenant decides which pages and actions are available. Roles, permissions, and the one-owner rule are covered in Tenants & RBAC.
Where to go next
Section titled “Where to go next”- Dashboard - the posture summary and what each tile actually measures.
- Cloud Accounts - connecting an account and setting its scan and discovery schedules.
- Datastores - the inventory, classification results, and the datastore detail drawer.
- How Argus Works - the engines behind the numbers, if you want the why before the where.