AiSOC
★ 2.8k
vs
ADR
★ 2.1k
AiSOC vs ADR
AiSOC: AiSOC is an open-source, self-hostable AI Security Operations Center designed to ingest security telemetry, detect and correlate threats, and investigate incidents using auditable AI agents. It provides proposed responses that require human approval, ensuring secure and transparent operations.; ADR: ADR (Agentic Detection and Response) is an open-source framework designed to secure AI agents utilizing the Model Context Protocol (MCP). It comprises an ADR Sensor for telemetry collection and an ADR Detector, which serves as a dual-agent benchmark and detection system.
Editorial Head-to-Head Analysis
ADR is research code for detecting attacks on MCP agents. AiSOC is a broader security operations stack for your existing telemetry.
01
TL;DR
AiSOCSecurity & Safety · ★ 2.8k
When to choose:
- You want a self-hosted SOC where an AI agent investigates incidents, logs every prompt and tool call, and a human approves each response.
- You want to run with no API key: it bundles a local `llama3.2:3b` model.
- Your telemetry is in Splunk, Sentinel, Elastic, CrowdStrike, Okta, AWS, Wiz or Kubernetes, among 84 connectors.
When to skip:
- You cannot give it 8 GB memory and 20 GB disk for the core profile, or about 12 GB for the full one.
- You need a hosted model: the README says no hosted model provider has been tested.
- You need proven detection: 2,603 of 6,991 rules are executable, which proves reachability, not that they catch attacks.
ADRSecurity & Safety · ★ 2.1k
When to choose:
- You research detection for MCP-based agents and want to reproduce the MLSys 2026 ADR paper.
- You want a benchmark: ADR-Bench has 133 MCP servers and 303 tasks with baselines.
- You want to collect telemetry from Claude Code, Cursor and Codex into one schema with the sensor.
When to skip:
- You want a packaged product to deploy: this is research code for a paper.
- You want the ADR Explorer red-teaming engine: the README says it is not included.
- You cannot pay for Anthropic and OpenAI API calls: the default detector needs both.
02
Side-by-Side Comparison
Field
AiSOCADRCategory
Security & Safety
Security & Safety
Stars
★ 2.8k
★ 2.1k
License
MIT
Apache-2.0
Install Command
git clone https://github.com/beenuar/AiSOC && cd AiSOC && make up
git clone https://github.com/uber/ADR && cd ADR/Detection && uv sync
Updated
1d ago
4d ago
Open Source
Yes
Yes
Tags
AI Security Operations, Threat Detection, Incident Investigation
AI Agent Security, Telemetry, Detection System
03
Features
AiSOC01AI-powered threat detection and correlation
02Auditable AI agent-led incident investigation
03Human-approved security response actions
04Support for 84 diverse data connectors
05Bundled local language model for immediate threat triage
ADR01ADR Sensor for collecting and normalizing agent telemetry.
02ADR Detector, a dual-agent detection system with 133 MCP servers and 303 benchmark tasks.
03Support for the Model Context Protocol (MCP) for securing AI agents.
04Provides a step-by-step workflow to reproduce benchmark detection and paper figures.
04
Use Cases
AiSOC↳Building a self-hostable AI-powered Security Operations Center.
↳Automating threat detection, correlation, and incident investigation.
↳AI-assisted triage and analysis of security alerts with auditable reasoning.
↳Integrating and normalizing security telemetry from various tools.
↳Consuming and utilizing CISA Known Exploited Vulnerabilities (KEV) for threat intelligence.
ADR↳Securing AI agents that use the Model Context Protocol (MCP).
↳Benchmarking and evaluating the security performance of agentic AI systems.
↳Collecting and analyzing telemetry data from various AI agent platforms.
↳Red-teaming and defensive security research for agentic AI.
05
Best For
AiSOCEssentialTrending
ADRTrending
FAQ
FAQ
What is the difference between AiSOC and ADR?
ADR is research code for detecting attacks on MCP agents. AiSOC is a broader security operations stack for your existing telemetry.
Which is better, AiSOC or ADR?
The best choice depends on your use case. Choose AiSOC if Building a self-hostable AI-powered Security Operations Center., and ADR if Securing AI agents that use the Model Context Protocol (MCP)..
Is AiSOC free or open source?
Yes, AiSOC is open source on GitHub (MIT).
Is ADR free or open source?
Yes, ADR is open source on GitHub (Apache-2.0).
Cloud Infrastructure
AdDeploy on DigitalOcean
Host your MCP servers, Docker containers, and AI agents with $200 free credit over 60 days.
→