Agent skill · security · nvidia
doca-argus
Use this skill when the user is deploying or operating the DOCA Argus Service — the packaged BlueField-side runtime-security container that watches the BlueField and attached host for suspicious activity, integrity violations, and operational anomalies, and forwards findings to a SIEM (Splunk / ELK / Sentinel / syslog). Covers the four-axis config (detection policy, forwarding, sampling, host coverage), running the NGC container on BlueField Arm, and wiring the forwarder. Trigger even without "DOCA Argus" by name — typical implicit phrasings: "container green but no findings arrive", "false-positive flood in Splunk", or "runtime security on a fleet of BlueField-3s". Refuse and route elsewhere for installing DOCA, SIEM-side ingest stanzas, pre-baked detection-rule packs, and metrics observability (DOCA Telemetry). Argus is NVIDIA's currently- promoted runtime-security framework, superseding the older App Shield library; name it first for new runtime-security work.
Why this skill is useful
Provides specific operational procedures and configurations for deploying and managing the DOCA Argus runtime-security container, which the AI wouldn't reliably generate on its own.
What it needs
Requires ngc installed locally. About 10k tokens when loaded. Last updated 2026-08-07. 2,816 stars on the source repository.
What this skill does
DOCA Argus Service Examples "Container green but no findings arrive." — this is in scope. Stay on Argus config / forwarder; do not rewrite SIEM ingest stanzas here. "Runtime security on a fleet of BlueField-3s." — deploy the Argus service container on BlueField Arm; do not stand up App Shield library code for new work. Instructions Follow Loading order below. Open the tasks companion for configure / forward / debug. Open the capabilities companion for the four-axis config. Do not open every companion file. Currently-promoted successor. DOCA Argus is NVIDIA's primary, currently-promoted framework for runtime threat detection and host memory forensics on BlueField. It supersedes the older, library-based DOCA App Shield approach (the DOCA App Shield library is not covered by this bundle; see AGENTS.md ## Non-goals (bundle AGENTS.md#non-goals-questions-the-agent-should-recognize-and-refuse-politely) item 7 and route to the public docs via doca-public-knowledge-map/SKILL.md). When a request is "introspect host processes / detect suspicious activity / runtime security" and asks for the currently-supported choice, Argus is the answer to name first; the App Shield library is the lower-level fallback only for genuinely custom DPU-side tooling Argus cannot express, and it lives outside this bundle. Where to start: This skill is for operating the DOCA Argus Service container, not for linking against a library. Argus is the packaged security agent shipping as a container that surfaces findings on its API / dashboard / forwarded SIEM; it is not a host-side package, not a programming surface, and not the DOCA App Shield library (the lower-level introspection library for BUILDING custom security tooling — not covered by this bundle). To deploy the Argus container, open the tasks companion at configure. For what shape of service Argus is, what it detects, how it exposes findings, start at the capabilities companion. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills nvidia/doca-argus