Argos: A Multi-Tenant SaaS Architecture for Distributed Edge Security Orchestration

Abstract

The growing adoption of distributed edge devices for security auditing and operational monitoring exposes limitations in lightweight control mechanisms traditionally used to manage such nodes. While commercial Command-and-Control (C2) platforms offer advanced orchestration features, their licensing constraints, operational complexity, and proprietary nature limit accessibility for small and medium-sized enterprises and research environments. This paper presents Argos, a multi-tenant SaaS C2 architecture designed for transparent, automated, and long-term orchestration of distributed edge devices. The framework implements a structured control plane with role-based access control (RBAC), tenant isolation, persistent task management, and cron-based workflow automation. Unlike operator-driven or stateless execution models, Argos enables scheduled and autonomous coordination of security tasks across heterogeneous environments. To formally substantiate its isolation guarantees, the platform is modeled through a set-theoretic authorization framework, and a tenant non-interference property is proven. The proposed architecture was evaluated across three geographically distributed edge devices, executing 810 automated tasks mapped to MITRE ATT&CK techniques. Results demonstrate a global failure rate of 3.33% (95% Wilson confidence interval: [2.30%, 4.81%]) with no statistically significant difference across ARM and x86 architectures (\c{hi} 2 = 1.55, p = 0.21), and stable operation under heterogeneous latency conditions, including intercontinental deployments. To ensure scientific transparency and reproducibility, the evaluation methodology, sanitized datasets, and statistical scripts have been made publicly available in an open-source repository.