[opensourcedex]

AiSOC is a free, open source ai security & privacy project written in Python and released under MIT. It has 2,396 GitHub stars, 263 forks and 26 open issues, and was last pushed 4 days ago. On this registry it ranks #12 of 34 tracked projects in AI Security & Privacy, with 5 head-to-head comparisons available. It gained 22 stars over the last 3 tracked days.

What is AiSOC?

What it is

AiSOC is an open-source, self-hostable Security Operations Center built with Python under the MIT license. It lives in the AI security and cybersecurity operations ecosystem, combining agentic AI, detection engineering, incident response, and MITRE ATT&CK investigation. The project presents itself as an AI SOC where an agent investigates security cases, uses tools, and records its reasoning for later review.

It addresses the volume and opacity of security alert triage. Security teams receive many alerts, must decide whether to escalate, review, or suppress them, and need investigation detail that explains those decisions. AiSOC aims to reduce manual triage by fusing alerts, supporting purple-team drills, and providing agent-assisted triage with logged, replayable prompts, tool calls, and rationale.

Key capabilities

  • Agent-assisted triage assigns alerts to escalate, review, or suppress verdicts through a deterministic scoring engine ported from the production triage scorer.
  • The wedge CLI can score a batch of alerts without an LLM key, as shown by the npx aisoc triage --demo path.
  • AiSOC supports MITRE ATT&CK investigation and incident-response workflows, including a seeded LockBit 3.0 case investigated end-to-end in the demo.
  • The agent records prompts, tool calls, and rationale step by step, and the project states that this investigation trail is replayable.
  • The topic list references LangGraph, ClickHouse, and Neo4j, indicating an agent graph plus analytics and graph storage for investigations.

Who uses it and how

  • Security operations teams can use AiSOC as a self-hosted triage assistant for alert queues when they need a repeatable investigation record rather than an opaque score.
  • Detection engineers and purple-team practitioners can test alert logic against seeded cases and review how an agent moves through Detect, Triage, Hunt, and Respond steps.
  • Evaluators can run the offline sandbox demo with Python 3.10+ without Docker or an LLM key, or try the hosted demo on Fly.io, Render, and GitHub Codespaces.

Getting started

The README describes running npx aisoc triage --demo, installing the sandbox package with pip install -e packages/aisoc-sandbox, and running aisoc-sandbox demo for an offline agent investigation.

When to use it — and when not to

AiSOC is a good fit when a team wants an MIT-licensed, self-hostable AI SOC platform with replayable agent reasoning and a no-LLM-key triage demo, but it is early-stage, with a zero-year repository age and a CLI path that still builds from the repository rather than a published npm package. The live demo can go offline, and self-hosting appears to involve operating the referenced ClickHouse, Neo4j, LangGraph, and Python components.

project readme (upstream, from github) — read inline

AiSOC

An open-source, self-hostable AI SOC. The agent's prompts, tool calls, and rationale are logged step-by-step and replayable. MIT-licensed.

License: MIT Version CI CodeQL OpenSSF Scorecard Discussions

Open in GitHub Codespaces Live demo on Fly.io Render demo (one-click)

The community-maintained demo at tryaisoc.com runs on Fly.io and can go offline; see docs/operations/live-demo-runbook.md and use Codespaces as the always-on fallback.


90-second walkthrough — agent investigates the seeded LockBit 3.0 case end-to-end. The rendered .mp4 + hero.gif land with the v8.0 launch; the brief is in docs/demo/SCREENCAST_SHOTLIST.md.

Try AiSOC in 60 seconds

One command — no clone, no Docker, no keys (npx aisoc lands on npm with the v8.0 launch; today it builds from packages/aisoc-lite/):

npx aisoc triage --demo
# ✓ AiSOC triaged 200 alerts: 12 TP, 171 FP suppressed (85.5% noise), 17 need review — in 0.1s

The wedge CLI scores a batch of alerts to verdicts (escalate / review / suppress) with a deterministic engine ported from the production triage scorer — zero LLM key required. Or pick whichever path matches what you already have on your machine:

If you have… Run this What you get
Python 3.10+ (no Docker) pip install -e packages/aisoc-sandbox && aisoc-sandbox demo Offline agent investigation walked through Detect → Triage → Hunt → Respond and printed to stdout. ** Does the demo still boot on main? Every push runs compose-smoke (the same pnpm aisoc:demo path you'd run locally) and e2e against the seeded console; nightly compose-smoke-nightly repeats it with cold caches. A red badge below is a release-blocker.

Compose Smoke Nightly cold cache E2E

Full multi-platform deploy guide is in apps/docs/docs/installation.md (Render, Fly.io, Docker Compose, Kubernetes, Terraform). Production-grade install with full storage tier: infra/helm/ or infra/terraform/.

What AiSOC is

AiSOC is a single self-hostable stack that ingests security events, correlates them, runs AI-driven investigation, and surfaces the result in a SOC console. The agent and the substrate are MIT-licensed, so you can read, fork, or replace either of them.

Three properties distinguish it from closed-source AI SOC vendors:

  1. Agent decisions are logged. The Investigation Ledger stores the LLM prompt, the response, the evidence cited, and the downstream tool calls for every step of every run. Replays are available later.
  2. The substrate has a public eval harness in CI. Five suites gate every PR targeting main / develop — alert reduction is a real measurement against a fixed 1 000-alert stream; three rubric-based suites are substrate self-consistency gates over a deterministic 200-incident dataset (55 templates) with per-template macros; a fifth gate validates the backing telemetry corpus. The benchmark page documents exactly what each suite measures and what it does not.
  3. You control what leaves your perimeter. No callbacks to a vendor cloud and no "model improvement" telemetry. With a hosted LLM, evidence is pseudonymized by default (internal IPs, hostnames, emails, paths, secrets, usernames become opaque tokens); run a local model (Ollama/vLLM) for a fully air-gapped path. Exactly what leaves under each mode: docs/trust/data-flows.md.

The orchestrator is a ~600-line LangGraph in services/agents/. It is small enough to read end-to-end, swap models in, and patch.

How AiSOC compares

Capability AiSOC Wazuh Splunk ES Closed-source AI SOC
Open-source license MIT GPL-2 proprietary proprietary
Self-hostable yes yes enterprise-only cloud-only
Autonomous AI investigation LangGraph no partial (Splunk AI) yes
Agent decision audit trail public Investigation Ledger n/a n/a not published
Public substrate eval harness CI-gated, reproducible, with synthetic telemetry corpus + per-template macros n/a n/a not published
Detection content 947 executable (869 native) firing on the live stream + 6

readme truncated — read the full docs on github

Frequently asked questions

Is AiSOC free to use?

AiSOC is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does AiSOC do?

Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-host

What is AiSOC written in?

AiSOC is primarily written in Python. Its source is publicly available at https://github.com/beenuar/AiSOC, and it has 2,396 GitHub stars.