ANIS Intelligence: Redesign intelligence dashboard with advanced analytics, decisions and ARGUS ↔ ANIS synchronization #7
Assignees
tech (Luis Melo)
Clear assignees
tech (Luis Melo)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: Weboria/argus-installer#7
Reference in New Issue
Block a user
Problem
The current Security / Intelligence (ANIS) page provides basic connection information but does not provide enough operational intelligence for a modern security appliance.
ARGUS integrates with ANIS (ARGUS Intelligence Network), but the current interface only shows:
The page should be redesigned into a complete Threat Intelligence Operations dashboard.
Goal
Transform the ANIS Intelligence section into an enterprise threat intelligence console.
The operator should understand:
New ANIS Intelligence Dashboard
1. Connection Overview
Keep the connection status but improve visualization.
Example:
ANIS Intelligence Network
Operational
🟢 Connected
Endpoint:
https://anis.weboria.eu/
Tier:
Community / Enterprise
Latency:
234ms
Last synchronization:
3 minutes ago
Data freshness:
Healthy
Add:
2. Intelligence Overview Cards
Replace simple counters with SOC-style cards.
Example:
Threat Intelligence Overview
3.1M
Known malicious IPs
7
Connected ARGUS instances
245
Threat detections today
98.7%
Feed availability
12,430
Blocked by ANIS intelligence
3. Threat Intelligence Charts
Add visual analytics.
Required charts:
Threat detections over time
Line chart:
Detections
|
| *
| * *
| *
|________________
24h
Show:
Threat categories
Donut chart:
Example:
Threat Categories
Botnet 45%
Scanner 25%
Malware 15%
Proxy 10%
Other 5%
Confidence distribution
Chart showing ANIS confidence levels:
High confidence
Medium confidence
Low confidence
4. ANIS Decision Engine
Add a section explaining automated decisions.
Example:
ANIS Security Decisions
IP reputation checked
↓
Threat confidence calculated
↓
ARGUS policy evaluated
↓
Action:
BLOCK
ALLOW
MONITOR
CHALLENGE
Show statistics:
Decisions today
BLOCK 12,430
ALLOW 95,200
MONITOR 4,320
CHALLENGE 1,200
5. Auto-ban Confidence Policy
The existing:
"Configure the ANIS auto-ban confidence policy"
should become a dedicated configuration card.
Explain:
"Controls when ARGUS automatically blocks attackers based on ANIS intelligence confidence."
Options:
Aggressive
Confidence:
70%
Balanced (Recommended)
Confidence:
85%
Strict
Confidence:
95%
Include explanation of risks.
6. ARGUS ↔ ANIS Synchronization
Add a synchronization panel.
Example:
ARGUS Intelligence Synchronization
Sending:
✓ Confirmed attacker IPs
✓ WAF violations
✓ Bot detections
Receiving:
✓ Community blocklists
✓ IP reputation
✓ Threat confidence scores
Last sync:
3 minutes ago
[ Sync Now ]
Show:
7. IP Intelligence Lookup
Improve the lookup section.
Current:
Check whether an IP is already known
Expand result.
Example:
IP Reputation Lookup
185.xxx.xxx.xxx
Risk:
HIGH
Confidence:
96%
Classification:
Malicious Scanner
First seen:
2026-06-01
Last seen:
2026-07-25
Sources:
ANIS Community
ARGUS Network
Recommended action:
BLOCK
8. Privacy Section
Keep the privacy explanation but improve presentation.
Example:
Privacy Protection
✓ Only attacker IP intelligence is shared
✓ Victim information is never shared
✓ Domains and customer data remain private
✓ Instance identity is anonymized
✓ SHA-256 irreversible identifier
9. Design Requirements
The ANIS page must follow the same ARGUS SOC design language:
It should look like:
Not a simple configuration page.
Backend/API Review
Review whether the API exposes enough intelligence data.
Required information:
If missing, add required API endpoints.
Example:
GET /api/v1/intelligence/status
GET /api/v1/intelligence/statistics
GET /api/v1/intelligence/events
GET /api/v1/intelligence/sync
GET /api/v1/intelligence/reputation/{ip}
Important Architecture Rule
ANIS endpoint remains fixed:
https://anis.weboria.eu
Customers must not be able to replace the intelligence provider.
Internal authentication keys remain hidden.
Final Goal
The ARGUS Intelligence page must become the operational bridge between:
ARGUS Security Appliance
↕
ANIS Intelligence Network
The operator should clearly see:
This should be a premium enterprise feature, not just a connection settings page.
Labels:
component:anis
component:security-intelligence
type:enhancement
priority:high
Moved to the correct repository: weboria/argus-appliance#8. argus-installer only tracks customer installer/deployment issues; this is a product feature, so tracking continues there (a private repo). Closing here.