doca-argus
Use this skill when the user is deploying or operating the DOCA Argus Service — the packaged BlueField-side runtime-security container that watches the BlueField and attached host for suspicious activity, integrity violations, and operational anomalies, and forwards findings to a SIEM (Splunk / ELK / Sentinel / syslog). Covers the four-axis config (detection policy, forwarding, sampling, host coverage), running the NGC container on BlueField Arm, and wiring the forwarder. Trigger even without "DOCA Argus" by name — typical implicit phrasings: "container green but no findings arrive", "false-
npx skills add NVIDIA/skills --skill doca-argus --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
This skill helps operators deploy and operate the DOCA Argus Service container on BlueField Arm. It covers watching the BlueField and attached host for suspicious activity, integrity violations, and operational anomalies, and forwarding findings to a SIEM (e.g., Splunk / ELK / Sentinel / syslog). It emphasizes configuring four axes: detection policy, forwarding, sampling, and host coverage, as well as running the NGC container on BlueField Arm and wiring the forwarder.
How it works
The skill describes operating workflows for Argus: deploying the Argus container on BlueField Arm (image source per the public DOCA Argus Service Guide), mounting the Argus config, and starting/stopping the container per the Container Deployment Guide. It explains the four configuration axes and the pairing surface to SIEMs, along with observability (container logs, finding feed) and error taxonomy. It provides step-by-step workflows in TASKS.md for verbs: configure, build, modify, run, test, debug. It notes that substantive material lives in CAPABILITIES.md (architecture, axes, deployment shape, forwarder surface, observability, safety policy) and TASKS.md (step-by-step workflows).
When to use it
Load this skill for hands-on Argus deployment work on a BlueField where DOCA is already installed. It is used when deciding whether Argus is appropriate versus other tooling, deploying the Argus container, choosing four configuration axes, wiring SIEM ingest, and validating end-to-end pipeline through calibration. It is also used for debugging when container is healthy but findings are not arriving or are overwhelming, or when Argus affects performance.
What it can touch
The skill describes touching the Argus container and the SIEM-forwarding surface. It references the ASG guiding materials (CAPABILITIES.md, TASKS.md) and the public Argus Service Guide for image source, container deployment pattern, and forwarder formats. It does not ship pre-baked configs or specific image names, tags, or registry paths.
Caveats
It explicitly states that this skill is an operator guidance bundle, not a programming guide or a library, and that it does not cover DOCA installation or SIEM-side ingest configuration in detail. It avoids shipping pre-baked Argus configuration files and does not provide DOCA App Shield content. It assumes DOCA is already installed on BlueField and that the operator has required privileges.
# DOCA Argus Service > **Currently-promoted successor.** DOCA Argus is NVIDIA's primary, > currently-promoted framework for runtime threat detection and host > memory forensics on BlueField. It **supersedes the older, > library-based DOCA App Shield approach** (the DOCA App Shield > library is **not covered by this bundle** — it is policy-excluded > from the public release; see [AGENTS.md `## Non-
What does the doca-argus skill do?
Use this skill when the user is deploying or operating the DOCA Argus Service — the packaged BlueField-side runtime-security container that watches the BlueField and attached host for suspicious activity, integrity violations, and operational anomalies, and forwards findings to a SIEM (Splunk / ELK / Sentinel / syslog). Covers the four-axis config (detection policy, forwarding, sampling, host coverage), running the NGC container on BlueField Arm, and wiring the forwarder. Trigger even without "DOCA Argus" by name — typical implicit phrasings: "container green but no findings arrive", "false-
How do I install it?
Run `npx skills add NVIDIA/skills --skill doca-argus --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From NVIDIA/skills, a repository with 2,789 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.