beenuar/AiSOC

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

What it solves

AiSOC is an open-source, self-hostable AI Security Operations Center (SOC) designed to automate the triage and investigation of security telemetry. It reduces the burden on security analysts by ingesting data from various security tools, detecting threats using a large library of executable rules, and using AI agents to investigate incidents with fully auditable reasoning. It ensures that response actions are human-approved, preventing autonomous AI errors in production environments.

How it works

AiSOC operates as a pipeline: telemetry is ingested and normalized to a common shape via connectors, then passed through a detection engine that runs thousands of executable rules to generate alerts. These alerts are grouped into incidents. AI agents then triage these incidents by reading alert context, entity context, and prior verdicts, and calling typed tools for lake queries and enrichment lookups. Every step of the agent's reasoning, including prompts and tool calls, is recorded in an Investigation Ledger for auditability. Response playbooks can be triggered, but they remain in preview mode by default and require explicit human approval before execution.

Who it’s for

Security operations teams and organizations that need a self-hostable, AI-powered triage and investigation platform that maintains strict human-in-the-loop control and full auditability of AI decisions.

Highlights

  • Auditable AI Agents: Every prompt, tool call, and verdict is logged to a signed evidence bundle for forensic auditability.
  • Extensive Detection Library: Includes thousands of rules, with a subset of over 2,600 rules proven to be executable against real telemetry.
  • Broad Connectivity: Features 84 click-and-connect data connectors for tools like Splunk, Sentinel, AWS, and Kubernetes.
  • Local LLM Support: Ships with a local model (Llama 3.2 3B) via Ollama for CPU-only inference, ensuring data privacy and zero-cost triage.
  • Governed Response: Response actions are gated by permission tiers and require human approval, preventing unauthorized autonomous actions.
  • Human-in-the-Loop: Playbooks include durable approval pauses that survive system restarts.

Related

  • Project
    FunnyWolf/agentic-soc-platform

    An open-source security operations platform that uses Agentic AI to automate alert triage, investigation, and knowledge accumulation for security teams.

  • Project
    Vigil-SOC/vigil

    An open-source AI SOC that uses specialized AI agents and Markdown-based workflows to automate security alert triage, investigation, and response.

  • Project
    Unclecheng-li/DeepSec

    An AI security platform combining a three-layer code auditing system (Shield) and an automated, authorized penetration testing engine (Spear).

  • Project
    Kritt-ai/open-kritt

    open·kritt is an open‑source, self‑hosted platform that orchestrates AI agents (via Codex, Claude Code, Grok Build, etc.) to run custom, prompt‑driven security workflows on code repositories. It builds focused tasks, runs them in parallel Docker containers, validates findings, de‑duplicates and ranks them, and exports a complete report bundle. Designed for bug‑bounty researchers and DevSecOps, it offers a web UI and a headless CLI, supports any model provider, and is released under AGPL‑3.0.

  • Project
    Tracer-Cloud/opensre

    OpenSRE is an open‑source framework for AI‑driven Site Reliability Engineering agents. It connects to 60+ observability, cloud, and incident‑management tools, fetches relevant context, runs a tool‑calling reasoning loop, and returns evidence‑backed diagnoses or remediation actions. Users can interact via an interactive shell, a headless CLI, or a Python API, and deploy the system via a managed cloud gateway, self‑hosted container, or EC2 AMI. The project is in public‑alpha (v0.1) and licensed under Apache 2.0.