Security Workbench + intelligent log patterns
- ▸Security Workbench: Argonix now runs the scanners itself. Declare a scan target — a repository, a container image or an authorized URL — and Argonix executes SAST (OpenGrep), secrets (Gitleaks), IaC (Checkov), SCA/containers (Trivy), SBOM (Syft) and DAST (OWASP ZAP) on its own scanner worker.
- ▸Per-commit scanning from signed GitHub/GitLab webhooks: pushes to your configured branch feed the persistent pipeline, other branches and merge requests run ephemeral scans that drive the deployment gate and post an MR/PR comment — without polluting your findings.
- ▸Vulnerability triage at CVE level: one decision per CVE instead of one per image, with CVSS, EPSS, CISA KEV, fix versions from OSV.dev, blast radius, and auditable risk decisions (organization or project scope, structured reason, expiry) that survive rescans.
- ▸SBOM inventories: versioned CycloneDX documents per target, component search and diffs between versions — answer "who ships log4j?" without rescanning.
- ▸Intelligent log patterns (Monitor → Logs): your logs are grouped into stable patterns across Loki, Datadog, Elasticsearch/OpenSearch, AWS CloudWatch, GCP Cloud Logging, Azure Log Analytics, Kubernetes and Falco. Argonix stores templates and counters, never raw logs.
- ▸Five detectors — new pattern, volume spike, share spike, resurfaced pattern, missing expected pattern — on robust median/MAD baselines with optional weekday/hour seasonality.
- ▸Anomaly-to-Action: every anomaly is correlated with the GitHub/GitLab/Argo CD/Helm/Terraform changes of the 24h before onset, resolved to affected resources and blast radius, and turned into ranked actions under your existing approval policy.
- ▸Log anomalies plug into alert rules, incidents, SRE Patrols, Health Notebooks and Argos investigations.