Argonaut Console

Security teams typically juggle SARIF outputs from multiple scanners, dependency lockfiles, SBOMs, threat intelligence feeds, and manual ticket creation across Jira/Slack. That workflow is brittle: the same vulnerability appears in multiple tools, reachability is unclear, and urgency is often guessed. Argonaut automates the full loop from evidence → context → action.

Argonaut reuses an existing local triage engine (Argus) for what it already does well—parsing SARIF, extracting dependencies from lockfiles/SBOMs, and computing reachability signals—then layers Agent Builder orchestration on top to make it an agent that "gets work done." Elasticsearch becomes the shared system-of-record and memory layer.

1. Acquire Workflow

pulls/accepts SARIF + lockfiles + SBOM, normalizes them, and indexes findings and dependency relationships.

2. Enrichment Workflow

attaches threat intel context (KEV/EPSS/advisory flags) and reachability confidence.

3. ES|QL Scoring Step

joins findings + threat intel + reachability to compute a Fix Priority Score and returns the top fix-first set with explanations.

4. Action Workflow

creates Jira tickets for the top items and posts a Slack summary that includes "why this is ranked #1," linking back to Kibana views.

What we liked / challenges:

We loved using Elasticsearch as both a hybrid retrieval layer (knowledge/runbooks) and a structured join engine (ES|QL) for scoring.
Workflows made multi-step automation reliable and demo-friendly (repeatable runs, clear progress stages).
The biggest challenge was designing index schemas that support both fast search and clean joins while keeping the demo data fully open/synthetic.

Judging Criteria Mapping

Alignment with official hackathon criteria

1. Technical Execution (30%)

Clear Multi-Step Agent: Supervisor plans, acquires, enriches, scores, and creates actions.
Agent Builder Use: Workflows (deterministic), Search (hybrid on knowledge), ES|QL (joins + ranking).
Clean Index Design: Purpose-built indices allowing structured joins, RAG, and stateful memory.

2. Impact & Wow Factor (30%)

Clear Problem: Reduces 800 findings → 5 fix-first in under 60s.
Measurable Impact: Saves ~90% time, reduces 6 steps to 1, eliminates manual joins.
Novelty: Executes downstream action, explains logic, and maintains audit memory.

3. Demo & Presentation (30%)

Visual Demo: Shows tool orchestration, ranked output, and Jira/Slack actions.
Clear Problem/Solution: Narrative flows from raw SARIF pain to one-click triage.
Screenshots: Agent Builder configs, ES|QL results, Kibana, Jira, Slack.

Competitive Positioning

Argonaut clearly demonstrates: Multi-step reasoning, Tool orchestration, Elasticsearch-first design, Real-world automation, Measurable impact, Explainable output, and Production-style architecture. This positions it strongly for Top 3 placement or at minimum Creative Award.