Argus

• 

  The investigation panel

Inspiration- Every single incident response tool out there in the market either comes with AI-assisted alert triage, or endpoint detection with automated response or a basic form of reasoning. I wanted one that could see what happened and clearly show me why it happened and what may have gone wrong.

What it does- Argus requires two sources of input, an organization's infrastructure and detailed logs from a cyber attack. From there, it analyzes logs, understands the organization's digital infrastructure and automatically generates a visual story of the breach, uses the reasoning power behind powerful AI models like GPT-5.6 to generate possible hypotheses while also informing the analyst what sort of missing evidence they should look for that would help investigate faster.

How I built it- Started with a detailed PRD, then used Codex CLI to scaffold a Next.js 14 app and build each feature as a focused task. GPT-5.6 powers the incident reasoning, generating structured JSON analyses that the frontend renders as interactive timelines and attack graphs. Built solo in under 2 days.

Challenges I ran into- Getting the attack graph to render different paths per hypothesis was harder than expected. Each hypothesis needed its own visual attack path on the same infrastructure, and shorter paths kept breaking the SVG rendering. Also spent time debugging JSON escape characters in the scenario data that crashed the parser.

Accomplishments that I'm proud of- The moment you click between hypotheses and watch the entire investigation view shift, different evidence highlights, different attack paths animate on the graph, different reasoning appears. That interaction is what makes ARGUS feel like a real investigation tool and not just a dashboard.

What I learned- Prompt engineering for structured JSON output is its own skill. Getting GPT-5.6 to consistently produce valid, schema-compliant analysis with realistic reasoning chains took more iteration than the UI work. Also learned how much Codex accelerates frontend development when you give it a detailed spec to work from.

What's next for Argus- Live API integration so users can paste any logs and get real-time analysis. Integration with real SIEM exports (Splunk, Sentinel). Architecture auto-discovery from cloud configs. A collaborative mode where multiple analysts can investigate the same incident and track evidence gaps together.

Built With

• att&ck
• codex
• css
• cybersecurity
• data
• gpt-5.6
• incident
• mitre
• next.js
• openai
• react
• response
• svg
• tailwind
• typescript
• vercel