doca-argus

# DOCA Argus Service > **Currently-promoted successor.** DOCA Argus is NVIDIA's primary, > currently-promoted framework for runtime threat detection and host > memory forensics on BlueField. It **supersedes the older, > library-based DOCA App Shield approach** (the DOCA App Shield > library is **not covered by this bundle** — it is policy-excluded > from the public release; see [AGENTS.md `## Non-goals`](../../../AGENTS.md#non-goals-questions-the-agent-should-recognize-and-refuse-politely) > item 7 and route to the public docs via > [`doca-public-knowledge-map`](../../doca-public-knowledge-map/SKILL.md)). > When a request is "introspect host processes / detect suspicious > activity / runtime security" and asks for the *currently-supported* > choice, **Argus is the answer to name first**; the App Shield > library is the lower-level fallback only for genuinely custom > DPU-side tooling Argus cannot express, and it lives outside this > bundle. **Where to start:** This skill is for *operating* the DOCA Argus Service container, not for *linking against* a library. Argus is the packaged security agent that ships as a container and surfaces findings on its API / dashboard / forwarded SIEM; it is *not* a host-side agent the user installs as a host package, *not* a programming surface, and *not* the same thing as the DOCA App Shield library (the *lower-level* introspection library a developer would use to BUILD custom security tooling — Argus is what most operators want INSTEAD; the...