Description
AiSOC is an open-source AI Security Operations Center (SOC) that integrates advanced AI capabilities to streamline and enhance security operations. Its core functionality revolves around alert fusion, where it consolidates and correlates security alerts from various sources to provide a unified view of potential threats. This helps security teams reduce noise and focus on critical incidents.
Read More
A key feature of AiSOC is its LLM-agent triage system. This system leverages large language models (LLMs) to automatically assess and prioritize security alerts, significantly reducing the manual effort involved in initial incident response. The agents are designed to understand the context of alerts and make informed decisions, accelerating the triage process.
Furthermore, AiSOC supports MITRE ATT&CK investigation, allowing security professionals to map detected activities to known adversary tactics and techniques. This framework provides a comprehensive understanding of attack patterns and helps in developing more effective defensive strategies. The platform maintains a replayable decision ledger for every agent step, offering complete transparency and auditability of all automated actions and decisions. This ledger is crucial for post-incident analysis, compliance, and continuous improvement of the security posture.
AiSOC is designed for self-hosting, giving organizations full control over their security infrastructure and data. It operates without requiring external API keys, which enhances security and reduces dependencies on third-party services. The project is MIT licensed, promoting open collaboration and allowing for flexible use and modification. It also ships with an MCP server, providing support for various models and tools, including Claude, Cursor, and Continue, making it a versatile solution for diverse security environments. The platform is continuously updated, with recent commits addressing installation fixes, web console improvements, and expanded detection capabilities.
- CategoryAI Cybersecurity Tools
- Pricing ModelOpen source
- DeploymentSelf-hosted
- PlatformsWeb
AiSOC's Core Features
Open-source AI Security Operations Center
Alert fusion for consolidated threat views
LLM-agent triage for automated alert prioritization
MITRE ATT&CK investigation support
Replayable decision ledger for agent actions
Self-hostable architecture
Operates with no API keys
MIT licensed for flexible use
Ships an MCP server for Claude, Cursor, and Continue
Supports endpoint discovery without new agents
Includes a native responder app and SDK
Offers observability and governance features
Provides GitHub rules alignment for connectors
Features a corpus of 68 hunts for threat detection
Getting Started with AiSOC
Clone the repository: Obtain the AiSOC source code from GitHub to your local environment.
Install dependencies: Follow the installation instructions, including any necessary package managers or environment setups.
Configure environment: Set up the required environment variables and configuration files, such as `.env.example`.
Deploy services: Use `docker-compose.yml` or Helm charts to deploy the necessary services, including the MCP server.
Run AiSOC: Start the AiSOC application and access its console to begin security operations.
Integrate detections: Align GitHub rules with the connector to integrate detection capabilities.
Investigate alerts: Utilize LLM agents and MITRE ATT&CK framework for alert triage and investigation.
AiSOC's Use Cases
- Automated Alert Triage
- Threat Investigation
- Security Operations Center (SOC)
- Incident Response
- Compliance and Auditing
- Self-Hosted Security
- Endpoint Discovery
