Rank #09 · Daily · Security
AiSOC: Self-Hostable AI Security Operations Center with a Replayable Agent Ledger
Self-hostable AI SOC that fuses alerts, investigates with auditable LLM agents, and keeps every prompt/tool call in a replayable ledger.
What it does
AiSOC is an open-source, self-hostable AI Security Operations Center. Telemetry arrives from connectors or push ingest; AiSOC normalizes events, runs detection rules (README cites a large on-disk library with an “executable earned by replay proof” gate rather than directory counting), correlates alerts into incidents, investigates with AI agents, and proposes responses a human approves.
Distinguishing public features:
- Investigation Ledger — every prompt, tool call, citation, verdict, and token cost; exportable signed evidence bundles (OCSF-oriented).
- Local model in core — Ollama-backed bundled ~2 GB model so
make upproduces real triage without API keys; optional GPU/host/remote providers from the console. - Threat intel without keys — CISA Known Exploited Vulnerabilities catalog ships in core; 91+ click-and-connect connectors plus collectors for CloudTrail/S3+SQS, GCP Pub/Sub, Azure Event Hubs, syslog/CEF.
- Governed response — playbooks preview by default; durable approval pauses survive restarts; no vendor action without explicit policy + human approver (unless tenant grants autonomy).
- MCP server for Claude, Cursor, and Continue; OpenAPI spec in-repo; docs portal and a technical guide PDF.
Quick start: git clone … && make up (Docker Compose v2; ~8 GB RAM / 20 GB free disk cited for core). Alternatives: install scripts, Codespaces, or pip install aisoc-sandbox && aisoc-sandbox demo offline. make smoke walks a real event through ingest → alert.
Who it’s for
Blue-team / detection engineers who want an open, self-hosted AI SOC with auditable agent steps—not a black-box SaaS triage bot. Comfortable running Docker Compose and connecting real sources. Explicit non-goals: not a drop-in long-term SIEM replacement; cannot see telemetry you have not connected; not autonomous by default.
Stars / language / license
~6,566 stars · Python · MIT
Data verified: 2026-11-02 ~22:16 Asia/Shanghai (GitHub API get_repository + README get_file_contents)
Trending note (selection ~22:14 Asia/Shanghai): ~+446 stars that day (archive)
Category tags
Security · AI-SOC · SIEM-adjacent · MITRE-ATT&CK · MCP · self-hosted · detection-engineering
How it differs from similar projects
Versus closed XDR/SOAR “AI copilots,” AiSOC’s Rising bet is open source + replayable agent ledger + human-gated response. Versus generic LLM chat over logs, agents call typed tools (model never writes SQL), grounding is checked, prompts are validated before send, and demos/samples are labelled synthetic. Published eval figures carry methodology links and “not measured” honesty for unfunded providers—treat them as project-reported with denominators, not TidyHow benchmarks. Development funded/supported by Cyble per credits; MIT licensed with no Cyble-only gated modules claimed in README.