Agentic SOC Platform
An open-source, agent-centric security operations platform that lets AI agents triage alerts, investigate cases, and enrich threat intelligence alongside human analysts.
Agentic SOC Platform is an open-source security operations platform built around agentic AI, so agents can participate in alert triage, investigation, enrichment and knowledge accumulation alongside a security team. It streams alerts from SIEM systems and webhooks, extracts indicators of compromise, correlates related signals, and converges large alert volumes into a smaller number of actionable Cases, Alerts and Artifacts.
An LLM-driven investigation flow produces severity, confidence, impact, priority, verdicts and structured reports automatically, and a Playbook system orchestrates traditional SOAR workflows together with AI analysis, launching investigation, knowledge extraction, and threat-intelligence or CMDB enrichment around each case. It supports multiple SIEM sources, including Splunk and ELK, exposes its capabilities to Claude Code, Codex, OpenCode and other harness agents through a CLI and plugins, and includes local/LDAP login, roles, API keys, notifications and an audit log for governance.
It is written in Python and TypeScript and can run as a private deployment; the project states an MIT license.