AiSOC
Self-hostable AI security-operations center that normalizes telemetry, correlates alerts, has local or provider-backed agents investigate through typed tools, records evidence, and requires approval before response actions. MIT licensed.
A self-hostable, MIT-licensed security operations center that normalizes telemetry and uses AI agents to investigate alerts with human approval.
What it is
AiSOC is an open-source, self-hostable AI Security Operations Center. It takes in security telemetry from your existing tools, normalizes it into a common shape, and runs a library of detection rules that group related signals into incidents. AI agents then investigate each incident through typed tools, and every prompt and tool call is recorded so the reasoning can be reviewed later. The project proposes response actions, but a person must approve them before anything is sent to a vendor. The README describes this flow end to end, from ingestion through correlation, investigation, and approval.
Key features
- Normalizes incoming telemetry into a common event shape, with activity fields such as actor, action, and outcome
- Runs a rule library, correlates related alerts into incidents, and applies tenant-specific tuning
- AI investigations use typed tools, and their prompts and tool calls are recorded in an audit ledger
- Requires human approval before response actions run, with playbooks that can preview their plan first
- Ships a bundled local model by default, and can alternatively use a host LLM or a hosted provider
Use cases
- Running a security operations workflow on your own infrastructure rather than a hosted SaaS
- Triaging alerts from existing tools, pushed through an ingest API or pulled through configured connectors
- Reviewing how an automated investigation reached its verdict, using the recorded audit trail
- Migrating existing Splunk, Sentinel KQL, or Elastic EQL detections, with untranslatable rules refused rather than approximated
Who it's for
Security teams that want an auditable, self-hosted alternative for alert triage and investigation. It also suits engineers who want to inspect how AI-assisted investigation works in practice.
Getting started
The README gives the setup path as cloning the repository and running make up from its root. It notes that Windows and machines without prerequisites can use an install script, that Docker Compose v2 with 8 GB memory and 20 GB free disk is needed, and that make smoke verifies the pipeline end to end. Sign-in details are printed by the setup command.
Alternatives
The related directory entries include OpenLIT, Opik (Comet), LiteLLM, Helicone, and Giskard. These are listed as neighboring projects in the same category, not as endorsed alternatives or equivalents.
Drafted with AI from the project's public documentation; verify against the source. Written 2 Nov 2026.