AiSOC

AiSOC is an open-source, self-hostable security operations center. Per the README, it ingests security telemetry, normalises it, runs detection rules, groups what fires into incidents, has an AI agent investigate each one with every prompt and tool call recorded in an Investigation Ledger, and proposes a response that a human approves before anything executes. Data comes in through an ingest API or from 84 click-and-connect connectors, with vendor-specific handling for Splunk, Microsoft Sentinel, Elastic, CrowdStrike, Okta, AWS, Wiz and Kubernetes audit logs.

The README is unusually candid. It says 2,603 of the 6,991 rules in the library are executable, and a rule only counts as executable after it has been replayed and watched to fire, which proves reachability but not that it detects a real attack. Triage runs on a bundled ~2 GB `llama3.2:3b` model that works on CPU, which it says is not a frontier model: over 50 alerts it gave usable output 44 times before the reply was constrained to JSON and 50 times after. It states that no hosted provider has ever been exercised, and it separates real, synthetic and benchmark data, linking a "reality audit" document.

Setup is `git clone` then `make up`, with `make smoke` to check an event travels through ingest, detection and the API. It needs Docker Compose v2 with 8 GB memory and 20 GB free disk, and the first run downloads the local model. A core profile runs 14 services, and a full profile with an event lake and entity graph runs 22 and needs about 12 GB. The licence is MIT and the last push was 2026-10-12. This review is based on the README and repository data; we have not run it ourselves.