AiSOC: Open-Source Self-Hosted AI Security Operations Center and Triage Tool

AiSOC is an open-source project for deploying and operating an AI Security Operations Center (SOC) on self-hosted infrastructure. It provides security telemetry ingestion and alert triage and can run without third-party API keys.

Image source: https://github.com/beenuar/AiSOC

The architecture normalizes incoming raw security events and couples deterministic rule-based threat detection with multi-step LLM agent investigations. By recording every prompt and tool call, it allows security teams to audit and replay AI triage investigations.

Rule-Based Detection and Auditable AI Investigation Ledger

AiSOC ingests telemetry across connected tools, normalizes disparate fields to a common schema, and attaches an activity projection to each event. It evaluates 2,530 executable detection rules from its 7,015-rule library, alongside 76 sliding-window rules, and groups related alerts into incidents.

• Investigation Ledger: Every prompt, tool invocation, and decision step generated by the AI triage agent is recorded sequentially, enabling full post-incident auditability and replay.
• Human-in-the-Loop Safeguards: Playbooks triggered by alerts preview actions before execution, and response actions require explicit human approval.
• Historical Threat Intelligence Sweeps: New threat intelligence triggers retrospective scans across previously collected data.

87 Connectors and MCP Server Integration

To support diverse enterprise monitoring estates, AiSOC includes 87 click-and-connect data connectors covering standard SIEM, identity, and cloud audit layers.

The platform provides native normalization profiles for platforms including Splunk, CrowdStrike, Okta, AWS, Microsoft Sentinel, and Elastic. Cloud-native collectors pull logs from S3 via SQS notifications, GCP Pub/Sub subscriptions, Azure Event Hubs, and Syslog/CEF listeners using bounded cursor budgets to prevent telemetry flooding. The included packages/aisoc-migrate utility translates existing Splunk SPL, Sentinel KQL, and Elastic EQL rules while explicitly rejecting incompatible logic instead of generating approximations.

Furthermore, AiSOC ships a built-in Model Context Protocol (MCP) server for integration with Claude, Cursor, and Continue.

Hardware Requirements and Deployment Guide

Distributed under the MIT license, AiSOC can run with its bundled local model without API keys.

The Docker VM environment requires Docker Compose v2, a minimum of 8 GB RAM, 20 GB of free disk space, Python 3.9+, and Bash. On the initial startup, the stack automatically retrieves a local model package of approximately 2 GB into a Docker volume.

• Full Stack Deployment:

git clone https://github.com/beenuar/AiSOC && cd AiSOC
make up

• Offline CLI Demo (without Docker):

pip install aisoc-sandbox && aisoc-sandbox demo

Running make up automatically generates fifteen internal secrets and prints an administrator password that is generated locally, shown once, and stored nowhere. Port collisions on standard ports such as 5432 or 11434 are dynamically resolved by shifting to open ports. End-to-end pipeline integrity can be verified via make smoke, which tests ten consecutive stages across Kafka, correlation, and Postgres.

Sources

• GitHub: beenuar/AiSOC Repository
• X (@doodi_dev): AiSOC Project Overview Post