Vigil
An open-source, agentic security operations center with specialized AI agents for tasks such as triage, plain-text playbooks for multi-agent workflows, and over 7,000 community detection rules, running against a locally hosted or remote LLM of the user's choice.
Vigil is an open source AI SOC built from three pillars: agents, workflows and integrations. Its roughly a dozen specialized AI agents, including a Triage agent, are readable Python that a user can fork and rewire, each with access to backend tools through an Agent SDK and to more than a hundred additional tools through over 30 MCP integrations; multi-agent playbooks are defined as Markdown files a user edits directly rather than a vendor-controlled configuration.
It runs on its own, from a local clone or Docker, against any LLM provider including a local Ollama model, and checks projected cost and confidence thresholds before executing an automation, asking a human first when a step looks too costly or too uncertain. An optional MCP integration adds LogLM, a cybersecurity foundation model for behavioral anomaly detection, but it is not required. The project is measured in the open by SOCBench and is released under Apache 2.0.