Repolode
Submit
beenuar

beenuar/AiSOC

Self-hostable open-source AI Security Operations Center that correlates alerts, runs LLM-agent triage with auditable logs, and proposes human-approved responses.

Open-source alternative to:Splunk SOARMicrosoft Sentinel

View on GitHubWebsite
Stars
3,220
Forks
343
Open issues
6
Last commit
2 days ago

What is it?

AiSOC is a self-hostable security operations center that takes telemetry from security tools, normalizes it, runs detection rules, groups related hits into incidents, and investigates them with AI agents. Each agent prompt and tool call is recorded in an Investigation Ledger, and any investigation can be exported as a signed evidence bundle.

The pipeline covers ingest, detection, correlation, alerting and triage. Connectors are provided for vendors such as Splunk, Sentinel, Elastic, CrowdStrike and Okta, and a generic mapping handles other sources. Threat intelligence from the CISA KEV catalog can be swept against previously collected events, and playbooks triggered by alerts run in preview by default, with approval steps before any vendor action.

The default install runs a local model through Ollama, so no API keys are needed. A quick start uses make up, and the project also ships an MCP server for Claude, Cursor and Continue.

Key features

  • 01Normalizes incoming telemetry and runs a large set of detection rules
  • 02Correlates alerts into incidents for investigation
  • 03AI agent triage with every prompt and tool call logged to a ledger
  • 04Connectors for Splunk, Sentinel, Elastic, CrowdStrike, Okta and more
  • 05Exports investigations as signed evidence bundles
  • 06Runs a local model by default and needs no API keys

Use cases

  • Running a small security team's alert triage on your own infrastructure
  • Auditing how an AI agent reached a verdict on an alert
  • Replaying new threat intelligence against historical security logs
  • Migrating existing Splunk, KQL or EQL detections into a new pipeline

Quick start

  1. 1

    Clone the repository

    git clone https://github.com/beenuar/AiSOC && cd AiSOC
  2. 2

    Start the stack with make

    make up
  3. 3

    Verify the install with the smoke test

    make smoke
  4. 4

    Sign in at the address make up printed

Things to know

  • Requires Docker Compose v2 with 8 GB memory and 20 GB free disk, and the first run downloads a ~2 GB model.
  • The bundled local model is not a frontier model and triage output is sometimes unreliable.
  • Some detection rules cannot fire yet, and the README says rule executability is still being proven.

In collections

Open-source AI agent frameworks & appsSelf-hosted apps

Topics

#security-operations#incident-response#ai-security#llm-agents#threat-detection#siem#mitre-attack#self-hosted#agentic-ai#alert-triage

FAQ

What is AiSOC?
Self-hostable open-source AI Security Operations Center that correlates alerts, runs LLM-agent triage with auditable logs, and proposes human-approved responses. AiSOC is a self-hostable security operations center that takes telemetry from security tools, normalizes it, runs detection rules, groups related hits into incidents, and investigates them with AI agents. Each agent prompt and tool call is recorded in an Investigation Ledger, and any investigation can be exported as a signed evidence bundle.
Is AiSOC free to use? What license does it have?
AiSOC is open source under the MIT license. Check the license terms before using it in commercial products.
Is AiSOC still maintained?
Actively maintained. The last commit to AiSOC was on Oct 22, 2026.
What can I use AiSOC for?
Running a small security team's alert triage on your own infrastructure Auditing how an AI agent reached a verdict on an alert Replaying new threat intelligence against historical security logs Migrating existing Splunk, KQL or EQL detections into a new pipeline
How do I install AiSOC?
Clone the repository: git clone https://github.com/beenuar/AiSOC && cd AiSOC Start the stack with make: make up Verify the install with the smoke test: make smoke Sign in at the address make up printed
Where can I get AiSOC?
The source code and installation instructions are on GitHub: https://github.com/beenuar/AiSOC

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects