Vigil-SOC/vigil

What it solves

Vigil is an open-source AI Security Operations Center (SOC) designed to replace "black box" proprietary AI security tools. It automates the complex process of security monitoring, alert triage, and incident response by providing a transparent, owner-operated system where the logic is readable Python and playbooks are plain-text files.

How it works

Vigil operates through three core pillars:

• Specialized AI Agents: It features 13 distinct agents (such as Triage, Investigator, and Malware Analyst) that handle specific security tasks. These agents use an Agent SDK and the Model Context Protocol (MCP) to interact with external tools.
• Workflows: These are multi-agent playbooks defined as Markdown files. A single command can trigger a sequence of agents (e.g., Triage $\rightarrow$ Investigator $\rightarrow$ Responder $\rightarrow$ Reporter) to execute an end-to-end security process.
• Integrations: Using the MCP standard, Vigil connects to SIEMs (Splunk), EDRs (CrowdStrike), threat intelligence feeds (VirusTotal, Shodan), and communication platforms (Slack, Jira) to gather data and take action.

Who it’s for

Security operations teams and analysts who want an autonomous or semi-autonomous SOC capability that they fully own and can customize without relying on vendor-locked proprietary software.

Highlights

• Agentic Architecture: 13 specialized agents with access to 19 backend tools and 100+ MCP tools.
• Human-in-the-Loop: Built-in safeguards where the system checks cost and confidence thresholds, requesting human approval for high-risk or expensive actions.
• Open Standards: Uses the Model Context Protocol (MCP) for integrations and Markdown for workflow definitions.
• Flexible Deployment: Supports local LLMs via Ollama, cloud providers (Anthropic, OpenAI), and can be deployed via Docker or Kubernetes.