AiSOC

beenuar/AiSOC is an open-source project by beenuar: Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.. Indexed here so it can be found — not resold.

It is free. Get it from the upstream repository: https://github.com/beenuar/AiSOC

From the project's own README (excerpt, reproduced for discovery under its MIT license):

AiSOC

An open-source, self-hostable AI Security Operations Center. It ingests your security telemetry, detects and correlates threats, investigates them with AI agents whose reasoning is fully auditable, and proposes responses a human approves.

Technical Guide (PDF) · Docs · Architecture · What actually works · Discussions

---

What AiSOC does

Telemetry arrives from your security tools. AiSOC normalizes it, runs the 2535 executable rules of its 6991-rule library, groups what fires into incidents, investigates each one with an AI agent whose every prompt and tool call is recorded, and proposes an action. New threat intelligence re-sweeps the history you already collected, and a human approves before anything reaches a vendor.

What it looks like running

Watch the full three minutes — install to AI verdict on one server against the published images, terminal waits shortened and the recording saying so on screen. The stills below are earlier runs under the same rules: no seeded rows, no demo mode, no mockups. (step by step · what is real)

--- --- Alerts — each attributed to the connector that fed it. Automated triage — the bundled local model's verdict, confidence and rationale, verbatim. Threat intelligence — the real CISA KEV catalog, minutes after boot, with no API key. SOC operations — with nothing connected yet, and it says so rather than showing a placeholder.

Quick start

The Technical Guide covers this in depth: server sizing, where the model runs, every failure mode with its cause and fix, the REST API, MCP, and every console surface.

Needs Docker Compose v2 with 8 GB memory and 20 GB free disk in the Docker VM, plus python3 (3.9+) and bash; make doctor checks all of it and Installation says what each number was measured against.…