AiSOC
An open-source, self-hostable AI security operations center that ingests security telemetry, correlates alerts into incidents, investigates them with an auditable AI agent, and proposes a response for a human to approve, running with no API keys required.
AiSOC ingests telemetry from a user's security tools, normalizes it, and runs it against an executable rule library to detect and correlate what fires into incidents. Each incident is investigated by an AI agent whose every prompt and tool call is recorded for audit, and the system proposes a response that a human must approve before anything runs; new threat intelligence re-sweeps history that has already been collected.
It installs through Docker Compose with a setup script that checks memory and disk requirements, downloads a roughly 2GB local language model on first run, generates its own credential-vault key, session signing key and service-to-service token, and creates an administrator account with a password shown once. A smoke test posts a real event through the ingestion API and follows it through the message queue, detection, correlation and the database to confirm the alert comes back out through the public API.
It ships an MCP server for use from Claude, Cursor and Continue, and is MIT licensed.