AI-SOC
A local, self-hosted security operations center that ingests Wazuh-format events, triages them with a local LLM, retrieves security knowledge for context, correlates incidents, and exports Sigma detection rules.
AI-SOC is a research security-operations platform combining Wazuh-format log ingestion, flow classification, local Ollama-based triage, retrieval-augmented security knowledge, incident correlation, analyst review, Sigma rule export and durable response plans, with a dashboard supporting viewer, analyst, reviewer and administrator roles.
It runs locally with Docker Compose for most services and a single isolated PostgreSQL container, alongside a natively installed Ollama; response execution defaults to a dry run. Setup generates a random per-installation admin password along with separate API, database and signing secrets, and existing credentials are preserved across restarts.
It requires Python 3.11, Docker, Ollama and an OpenMP runtime, with roughly 16 GB of RAM recommended, and the maintainers describe it as having passed native and containerized workflow checks along with a disposable Wazuh/Linux response lab.