beenuar/AiSOC

AiSOC is an open-source, self-hostable security operations system: it ingests telemetry from security tools, runs detection rules, groups fires into incidents, and lets an AI agent investigate and propose a response that a human must approve. It fits teams that want an auditable alert-triage pipeline on their own hardware rather than a hosted SIEM replacement.

What changes in practice

Telemetry comes in either by pushing to the ingest API with a tenant-scoped credential, or by configuring one of the 87 click-and-connect connectors. Events are normalized, carried over Kafka, matched against the detection engine, correlated into incidents, then triaged by an agent that writes prompts, tool calls, citations and verdict into an Investigation Ledger; the ledger exports as a signed evidence bundle. Two mechanisms stand out: a rule only counts as executable after a vendor-shaped event is replayed through the real connector and watched to fire, and an investigation citing evidence that never existed is demoted to human review instead of auto-closed. Response actions stay off unless deployment, tenant and playbook switches all agree, and approvals pause durably to Postgres so they survive a restart.

Running it

make up is the smallest real path: 16 services, roughly 8 GB RAM, requiring Docker Compose v2, about 20 GB free disk in the Docker VM, python3 3.9+ and bash; make doctor verifies these, and the requirements page states what each figure was measured against. The first run pulls a pinned ~2 GB local model, so triage produces real verdicts with no API key or credentials. Alternatives exist for specific paths: PowerShell/installer scripts on Windows or a bare machine, a pip install aisoc-sandbox offline demo with no Docker, and GitHub Codespaces. The full profile adds about 4 GB and the lake, graph, search and enrichment services. See the installation requirements and architecture walkthrough.

Constraints worth knowing

• The bundled local model is not a frontier model: the author reports usable triage output on 44 of 50 alerts before JSON constraining and 50 of 50 after. No hosted provider had been exercised, so those rows read "not measured" rather than zero (where the model runs).
• Stable status is tied to PR-gated tests with negative controls, not to stars or age (maturity definition). The event lake, retro-hunts, entity graph and UEBA are full-profile features.
• Ingesting existing Splunk rules does not mean fidelity: of 2,005 bundled Splunk rules, 1,734 translate and 1,711 of those are partial (Splunk migration).
• The project explicitly is not a drop-in SIEM replacement, cannot see unconnected telemetry, and is not autonomous by default. MIT licence; the author publishes a repository reality audit listing where claims did not match coverage.

HotRepo's take

A single daily-board observation on 2026-10-28 showed 4,729 stars; one recorded day is not enough to describe momentum.