AiSOC

Overview

AiSOC is an open-source, self-hostable AI Security Operations Center for security telemetry ingestion, alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and human-approved response. Agent decisions are recorded in an investigation ledger and can be replayed, and a public eval harness runs in CI. The project is MIT-licensed, runs without requiring API keys, and ships an MCP server for Claude, Cursor, and Continue.

Key Features

• Agent decisions are recorded in an investigation ledger and can be replayed step by step.
• A public eval harness provides a 200-incident, CI-gated regression suite over the AiSOC substrate.
• LangGraph multi-agent investigation uses recon, forensic, responder, and reporter agents.
• Real-time fusion runs on Kafka with Bloom-filter dedup and ML scoring.
• Detection engineering supports Sigma over OpenSearch and ClickHouse, YARA, KQL, and EQL, with an ATT&CK heatmap and purple-team tooling.
• Enterprise governance includes SAML 2.0 and OIDC SSO, multi-tenant Postgres RLS, RBAC, and an immutable audit log.

Use Cases

• Security operations teams can aggregate alerts, triage incidents with LLM agents, and review the reasoning behind each decision.
• Organizations that need a self-hosted SOC can run AiSOC without API keys using the bundled local model.
• Detection engineers can migrate Splunk SPL, Sentinel KQL, and Elastic EQL rules or install Sigma, YARA, KQL, and EQL detections.
• Purple teams can use Atomic Red Team parsing, Caldera execution, and ATT&CK coverage heatmaps.

Getting Started

• Clone the repository and run make up to start the core stack.
• On Windows, or on a machine without prerequisites, use the PowerShell installer; on Linux or macOS, use the shell installer.
• Without Docker, install aisoc-sandbox and run aisoc-sandbox demo to walk one alert through the agent funnel offline.
• After startup, run make smoke to send a real event through ingest, detection, correlation, and Postgres, then read the alert back from the public API.
• Run make doctor to check host tools, memory, disk, ports, and datastores.

Deployment & Requirements

• Docker Compose v2 with 8 GB memory and 20 GB free disk in the Docker VM.
• python3 3.9+ and bash.
• The first run downloads a roughly 2 GB model into a volume that make clean clears.
• Core profile uses 16 services and about 8 GB RAM; full profile uses 22 services and about 12 GB RAM.

Before You Adopt

• License: MIT. Review its terms before using, modifying, or distributing the project.
• AiSOC is not a drop-in SIEM replacement; long-term log retention and compliance search remain separate concerns.
• Response actions are not autonomous by default and require explicit policy authorization and a human approver.
• Benchmark numbers are substrate self-consistency measures, not live agent accuracy.
• Collecting real cloud logs requires dedicated collectors rather than relying only on REST calls.