AI product Open source · MIT
AiSOC is an open-source, self-hostable AI Security Operations Center for ingesting security telemetry, detecting and correlating threats, investigating incidents with AI agents, and proposing human-approved response actions. It normalizes events into a common activity shape, carries them through Kafka, applies executable detection and sliding-window rules, groups resulting alerts into incidents, and can resweep collected telemetry when new threat intelligence arrives.
Its agents read alerts, correlated entities, and prior verdicts, then use typed tools for lake queries, graph traversal, and enrichment rather than writing SQL. Prompts, tool calls, citations, verdicts, and token costs are recorded in an auditable Investigation Ledger, with signed evidence-bundle exports and grounding checks that can demote unsupported conclusions to human review. Playbooks are previewed by default; response actions require explicit authorization and human approval unless tenant policy grants autonomy for a specific verb.
The project includes a local Ollama-served model, a REST API, web console, MCP server, connectors and collectors for security data sources, and a CISA Known Exploited Vulnerabilities feed that requires no API key. It runs with Docker Compose, can be deployed in core, full, or demo profiles, and is distributed under the MIT license. The repository states that AiSOC is not a drop-in SIEM replacement and cannot observe telemetry that has not been connected.