Overview#
A suspicious activity report arrives at a fusion centre at 11pm. Within minutes, it is cross-referenced against travel records from a federal database, financial transactions flagged by a local field office, and a social media alert generated by an automated monitoring system. Three agencies contributed the pieces; none of them alone had the full picture. That kind of rapid, structured intelligence fusion is what JTTF operations demand, and it is what the Argus platform is designed to deliver.
Argus JTTF Operations provides secure infrastructure for counterterrorism investigations that require integration of intelligence, evidence, and coordination across local, state, and federal law enforcement agencies. The platform unifies counterterrorism workflows, automates watchlist screening, enables secure multi-agency collaboration, and ensures compliance with FBI CJIS Security Policy and Intelligence Community standards.
Open Standards#
- OASIS STIX 2.1 / TAXII 2.1: Intelligence is structured, ingested, exported, and shared as STIX 2.1 bundles and Structured Threat Information eXpression objects; automated polling of remote TAXII 2.1 feeds is supported for continuous multi-agency intelligence exchange.
- MITRE ATT&CK: Threat actor attribution and investigation workflows map observed tactics, techniques, and procedures directly to MITRE ATT&CK technique identifiers, enabling structured TTP overlap scoring and comparative threat profiling.
- 28 CFR Part 23: Criminal intelligence sharing controls implement the source reliability and content validity classification codes mandated by 28 CFR Part 23, with compliance documentation enforced for all records classified as criminal intelligence.
- FBI CJIS Security Policy: Multi-level access controls, audit logging, compartmented need-to-know enforcement, and personnel security tracking are implemented to satisfy FBI Criminal Justice Information Services Security Policy requirements.
- FATF Recommendations / OFAC, UN, EU, and UK Sanctions Regimes: Terrorism financing screening uses nightly-synchronised OpenSanctions bulk data aggregating OFAC, UN Security Council, EU, and UK sanctions lists; compliance with FATF counter-terrorism financing recommendations is cited as the regulatory basis for mandatory screening.
- SAML 2.0 / OpenID Connect (OIDC): Federated single sign-on for multi-agency access is implemented via SAML 2.0 and OIDC identity providers, with provider type stored as a first-class configuration attribute on external-sharing sessions.
- NIEM (National Information Exchange Model): The ingestion pipeline treats NIEM as one of the named open international standards that connectors implement when normalising law enforcement data for cross-agency interoperability.
Last Reviewed: 2026-02-23 Last Updated: 2026-04-14
Key Features#
Intelligence Fusion#
- Multi-source threat intelligence fusion aggregating and analysing intelligence to identify terrorism threats before attacks occur
- Suspicious activity reporting integration with automated triage and threat correlation
- Counterterrorism analytics with pattern analysis, behavioural indicators, and threat scoring
- Travel pattern analysis identifying suspicious travel to conflict zones and high-risk destinations
- Social media and open-source intelligence monitoring for threat indicators and radicalization markers, drawing on over 153 integrated third-party data sources including MISP and OpenCTI
- Source and informant management with compartmented handling and need-to-know enforcement
- Radicalization pathway tracking mapping progression from initial exposure through operational planning
- STIX/TAXII-format intelligence structures for interoperable sharing across participating agencies
Investigation Management#
- Multi-agency investigation management with secure case files, evidence sharing, and coordinated operations
- Multi-case management allowing analysts to run parallel investigations with shared entity intelligence
- Evidence chain of custody with court-admissible documentation standards
- Surveillance coordination tools for multi-agency monitoring operations
- Informant management with source protection and intelligence evaluation
- Financial intelligence integration tracking terrorism financing, money laundering, and material support across traditional banking and 15+ blockchain networks
Screening and Monitoring#
- Automated watchlist screening against federal terrorism watchlists and no-fly lists
- Continuous monitoring of subjects of interest with automated alert generation
- Nomination processing for adding subjects to appropriate watchlists
- Screening result review and adjudication workflows for match management
- Historical screening audit trails for compliance and accountability
- Foreign fighter tracking with travel intelligence and returning combatant monitoring
- Online extremism monitoring tracking propaganda distribution and recruitment activity
- OpenSanctions integration for real-time screening against OFAC, EU, UN, and UK sanctions lists
Security and Compliance#
- Classified data handling with multi-level security controls meeting Intelligence Community standards
- Secure communications supporting encrypted messaging, file sharing, and video conferencing
- Compliance with 28 CFR Part 23, CJIS Security Policy, and Intelligence Community directives
- Compartmented access controls ensuring need-to-know protections across all shared intelligence
- Complete audit logging of all access, searches, and actions within the platform
- Regular security review and re-certification processes for continued system authorisation
- Personnel security management tracking clearances and access approvals for task force members
- Training compliance tracking for counterterrorism investigation standards and procedures
- Information handling violation detection with automated alerting for policy breaches
Use Cases#
Threat Intelligence Fusion. Aggregate intelligence from FBI, DHS, NCTC, fusion centres, and field reports to identify emerging terrorism threats through entity resolution, link analysis, geographic clustering, and predictive analytics. Prioritise threats for investigation and response.
Multi-Agency Counterterrorism Investigation. Manage joint investigations across federal, state, and local agencies with secure case management, evidence sharing, surveillance coordination, and prosecution support. Maintain operational security while enabling effective multi-agency collaboration.
Watchlist Screening and Monitoring. Automate screening of subjects against terrorism watchlists, track watchlist nominations, and monitor subjects of interest with real-time alert generation. Ensure comprehensive screening coverage across all relevant databases.
Radicalization Detection. Identify indicators of radicalization through behavioural analysis, social media monitoring, travel patterns, and financial activity to enable early intervention and prevention. Support community-based prevention programmes with intelligence products.
Countering Violent Extremism. Support prevention-focused programmes by identifying individuals at risk of radicalization, coordinating with community organisations and mental health providers, and tracking intervention outcomes. Balance security objectives with community engagement and civil liberties protections.
Integration#
- Connects with FBI, DHS, and Intelligence Community systems for threat intelligence sharing
- Integrates with federal watchlist and screening databases for comprehensive subject monitoring
- Links to financial intelligence and transaction monitoring platforms for terrorism financing
- Works with surveillance and communications monitoring systems for coordinated operations
- Supports secure multi-agency coordination and deconfliction to prevent operational interference
- Compatible with evidence management systems for court-ready case documentation
- Feeds into national counterterrorism intelligence frameworks for strategic threat assessment
- Supports civil liberties compliance documentation for oversight and audit requirements
- Domestic violent extremism monitoring across ideological categories and threat streams
- International terrorism coordination connecting local investigations to global intelligence
- Connects with border security systems for subject monitoring at ports of entry
- Integrates with financial institutions for terrorism financing detection and reporting