beenuar/AiSOC

What it solves

AiSOC is an open-source, self-hostable Security Operations Center (SOC) designed to automate the ingestion, correlation, and investigation of security events. It addresses the noise and opacity of traditional SOC tools by providing an AI-driven investigation process where every decision is transparent, logged, and replayable.

How it works

AiSOC uses a multi-layered architecture to handle security data:

• Ingestion & Normalization: It connects to various security sources (EDR, SIEM, Cloud APIs) via 80+ connectors, normalizing data into an OCSF format and streaming it through Apache Kafka.
• Detection & Reasoning: A combination of ML-based fusion, UEBA, and a rule engine (Sigma, YARA, KQL) identifies threats. AI agents, built with LangGraph, then perform autonomous triage and investigation.
• Storage: Data is stored across a specialized tier including ClickHouse (event lake), PostgreSQL, OpenSearch, Qdrant, and Neo4j.
• Transparency: The "Investigation Ledger" records every LLM prompt, tool call, and rationale, allowing analysts to audit the AI's logic.
• Governance: An autonomy policy manages response actions based on confidence, blast radius, and reversibility, ensuring high-risk actions require human approval.

Who it’s for

Security analysts and SOC teams who need an automated, transparent AI-driven investigation platform that they can self-host to maintain full control over their data residency and privacy.

Highlights

• Open Investigation Ledger: Full audit trail of AI agent decisions, prompts, and evidence.
• Harness-Gated CI: Public evaluation suites that measure alert reduction and consistency on every PR.
• Federated Search: Ability to run SIEM-agnostic queries across Splunk, Sentinel, Elastic, and QRadar.
• Privacy-First: Supports pseudonymization of evidence and local LLM execution (Ollama/vLLM) for air-gapped environments.
• MCP Server: Integration with Model Context Protocol for use within IDEs like Cursor or Claude.
• Detection-as-Code: A lifecycle for proposing, reviewing, and evaluating detection rules with automated fixtures.