Argos turns a clean Ubuntu Budgie 24.04 or 26.04 LTS virtual machine into an OSINT workstation: it installs the tools, adds a menu entry for each task, and saves every result in a case folder with the command used, the full output and SHA-256 hashes.

3.3.1-beta. Version 3 is a complete rewrite. The full installation of 3.0.0-beta has been tested on virtual machines with Ubuntu Budgie 24.04.5 and 26.04.1 LTS, and the launchers are covered by automated tests, real dialogs included. 3.1.0-beta added two case graphs, Quaesitor and Flowsint, still to be tested on a virtual machine. 3.1.2-beta aligned the analysis guidelines and the report templates with the Intelligence Field Notes (UNODC 4 x 4 source grading, one ICD 203 likelihood row); 3.1.3-beta adds key judgements, gaps and annexes to the report templates, separate from the findings. 3.2.0-beta adds ONLYOFFICE Desktop Editors to open and fill the .docx report templates; 3.2.1-beta revises the Firefox extensions and 3.2.2-beta fixes the Firefox privacy policy; 3.2.3-beta adds Consensus, one search over the lookup catalogues of 19 username and email projects, and 3.2.4-beta saves its scan as JSON with the HTML report derived from it, with an optional Tor route. 3.3.0-beta adds EditSimple, a video editor that turns footage into evidence (tracking, zoom, pixelation, slides); 3.3.1-beta installs it from a fork with the Linux fixes, tested on Ubuntu 24.04 in a virtual machine. Field testing on Ubuntu Budgie 24.04 and 26.04 LTS desktops continues before the stable release: please report problems in the issues.

• What Argos does
• Requirements
• Installation
• Working with cases
• Launchers
• Other tools installed
• Privacy and OPSEC
• Report templates
• Development and tests
• Resources · Credits · Licence
• Architecture · FAQ · Analysis guidelines · Writing the report · Intelligence Field Notes · Version history

• One menu entry per investigative task: usernames and emails, Instagram, domains and URLs, web screenshots, public documents and metadata, video download and analysis, Shodan, SpiderFoot, phone numbers, recon-ng, website copies and crawls, two case graphs in the browser (Quaesitor and Flowsint) and a video editor to present what a video shows (EditSimple).
• Cases: choose a case once, and every result lands in ~/Documents/Argos/cases/<case>/.
• Evidence you can defend: each run folder holds command.txt (exact command, tool version, UTC start/end, exit code), output.log (everything the tool printed) and SHA256SUMS (hash of every file produced).
• Up-to-date tools: Amass v5, theHarvester 5, subfinder, katana, gau, current Maigret with PDF reports, yt-dlp with deno for YouTube, SpiderFoot from source, Shodan CLI that actually starts, binaries downloaded from the official releases with their checksums verified.
• Same result on 24.04 and 26.04: the Python tools run in environments managed by uv on a fixed, tested Python version, whatever Python the system ships.
• Works on the desktop and in a terminal: dialogs on the desktop, plain prompts over SSH; a running tool can be cancelled from its progress window.

• Ubuntu Budgie 24.04 LTS or 26.04 LTS, preferably a dedicated virtual machine for each investigation.
• A user with sudo rights (do not run the installer as root).
• System language: English. Argos uses the standard English folder names (~/Documents, ~/Downloads, ~/Pictures, ~/Templates).
• Internet access during the installation.
• VirtualBox users: install the Guest Additions first; Argos does not.

sudo apt install -y git
git clone https://github.com/SOsintOps/Argos.git
cd Argos
./setup.sh

The installer can be run from any folder. It logs everything to ~/Downloads/argos_install_<date>.log, carries on when a single tool fails, and lists all problems in a summary at the end. Reboot when it finishes.

The menu entries are under Internet in the application menu; you can also search them by name (for example "Argos Case" or "Usernames"). Open Argos Check first: it starts every tool and reports anything that is missing or broken.

Each launcher can also be started from a terminal, where it asks its questions as text:

~/.local/share/argos/launchers/usernames.sh

Run only some steps, for example to update the launchers after a git pull:

./setup.sh --list          # show the steps
./setup.sh launchers       # reinstall launchers, icons and menu entries
./setup.sh python-tools amass theharvester   # update those tools

1. Open Argos Case and create a case (for example 2026-017-fraud). The case folder starts with notes/ (research log and CherryTree notebook), reports/, manual-captures/ and deliverables/.
2. Use any launcher: results go to ~/Documents/Argos/cases/2026-017-fraud/<tool>/<UTC time>_<target>/.
3. Quote the run folder and the SHA-256 in your report's source table.

Without a case, results go to the case unsorted.

How actively each tool is maintained by its authors (checked October 2026). Every tool works with Argos today; "low" and "unmaintained" tools may break when the services they query change.

EditSimple is installed from the SOsintOps fork (branch linux, with the Linux fixes proposed to its author) in ~/.local/share/argos/tools/editsimple, where it also keeps its settings (config.json) and its tools/ folder. The installer downloads there the VitTrack tracking model (opencv_zoo, Apache-2.0, checked against its SHA-256) and, when the system ffmpeg is older than 7 (Ubuntu 24.04 ships 6.1), a release build of ffmpeg from BtbN/FFmpeg-Builds, as EditSimple asks for ffmpeg 7 or later.

Flowsint runs in Docker: the installer adds your user to the docker group, active after the reboot, and keeps the generated passwords in ~/.config/argos/flowsint.env (never delete that file: the databases are initialised with them). Its containers mount the Docker socket, as its own docker-compose.prod.yml requires.

Audacity, CherryTree, Google Earth Pro, Kazam, KeePassXC, MediaInfo, Obsidian (with OSINT templates), ONLYOFFICE Desktop Editors (opens the .docx report templates), OpenShot, ripgrep, Tesseract OCR (with the Italian, Chinese, Russian and Arabic language packs, used by Quaesitor for scanned documents), Docker (for Flowsint), Tor Browser, proxychains, VLC, VSCodium, 7-Zip, and the threat intelligence and intelligence writing reading lists and the Intelligence Field Notes in ~/Documents/Resources. Firefox gets enterprise policies for privacy, OSINT bookmarks and 17 extensions: uBlock Origin, CanvasBlocker, ClearURLs, Multi-Account Containers, Exify, Wayback Machine, Web Archives, Resurrect Pages, Search by Image, Link Gopher, Mitaka, Sputnik, Wappalyzer, IP Address and Domain Information (DNSlytics), Hunter, User-Agent Switcher and Manager and SingleFile. Hunter needs an account and sends the visited domains to its service; Wappalyzer is closed source. Full-page screenshots use the one built into Firefox (Ctrl+Shift+S). The same policy locks strict tracking protection and fingerprinting protection, disables WebRTC, geolocation, telemetry and Safe Browsing and clears the browsing data on shutdown; the FAQ lists every setting and how to change it.

Maltego is not installed (it needs an account); install it manually if you use it.

• Options that send your target to a third-party service (Blackbird AI, Hudson Rock breach lookups, the Telegram check) are off by default and ask for confirmation each time, naming the service.
• Options that can alert the target (User Scanner "loud" checks, Amass active checks) show a warning first.
• API keys and session IDs are never written to command.txt; the Telegram login session is kept in ~/.config/argos/telegram, outside the cases.
• Instaloader uses the session of your Firefox research account: Argos never asks for, or stores, an Instagram password.

~/Templates receives report templates written for Argos: full report, executive summary, subject profile, event assessment, threat notice, case cover sheet with chain of custody, online investigations policy, a plain Markdown report, a research log (CSV), scratch notes and a CherryTree case notebook. Their source table links each finding to an Argos run folder and its SHA-256 and grades it on the UNODC 4 x 4 scale; findings state facts only, while the key judgements carry a confidence level or one of the ICD 203 likelihood terms. Which template to use, and how to fill it, is in Writing the report. The .docx files are generated by templates/src/build_templates.py; ONLYOFFICE Desktop Editors, installed by setup.sh, opens them.

shellcheck -x -P launchers -P SCRIPTDIR/../.. setup.sh launchers/*.sh launchers/lib/argos.sh tests/gui/smoke.sh
bats tests/
tests/gui/smoke.sh      # real zenity dialogs on a virtual display

The tests run the launchers in terminal mode against test doubles of every tool: no network, a few seconds. tests/gui/smoke.sh drives the real zenity dialogs on a virtual display (needs xvfb xdotool x11-utils). See docs/ARCHITECTURE.md.

• OSINT Ops website
• The Argos Project: an OSINT-ready VM in minutes
• Argos is back, and it's not alone!
• OSINT Daily News
• Intelligence Field Notes: analytic standards, OSINT method, source evaluation and report writing for all the SOsintOps tools
• OSINT Techniques (11th edition) by Michael Bazzell and Jason Edison
• Deep Dive: Exploring the Real-world Value of Open Source Intelligence by Rae L. Baker

• Argos started from Skykn0t's OSINT_VM_Setup script and the workstation approach described by Michael Bazzell. Version 3 is a new implementation: its code, launchers, icons and templates were written from scratch.
• oh6hay for the name.
• The authors of every tool Argos installs: their licences apply to their tools.
• Media credits: multimedia/CREDITS.md.

Argos is released under the MIT licence. Versions up to 2.1.1-beta were distributed under CC BY-NC-SA 4.0 and remain available under that licence in the repository history.