beenuar/AiSOC

Health v2 · maintenance only

Flags: young

Adoption not part of the score

2408 stars · 254 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

AiSOC is an open-source, self-hostable AI-powered Security Operations Center that fuses alerts, performs agent-assisted triage, purple-team drills, and MITRE ATT&CK-aligned investigations with replayable agent traces. It includes a deterministic triage CLI, 70+ data connectors for SIEM/EDR/cloud/identity sources, and is MIT-licensed.

Use cases

• triage security alerts with AI agents
• fuse and correlate alerts from SIEM and EDR
• investigate incidents mapped to MITRE ATT&CK
• run purple-team detection drills
• score alert batches to escalate/review/suppress verdicts
• self-host a SOC platform with replayable agent audit trails
• hunt threats with plain-language queries across connected sources

When to choose

• you want an open-source, self-hostable alternative to commercial SIEM/SOAR triage
• your team needs agent-assisted alert triage with auditable, replayable reasoning
• you need integrations across Splunk, Sentinel, CrowdStrike, Defender, and cloud logs
• you want a deterministic CLI triage scorer without LLM keys

When to avoid

• you need a fully managed multi-tenant MSSP platform with SLAs and compliance reports
• you require guaranteed vendor support and SOC 2/ISO attestations from the open-source edition
• your environment cannot run Python/ClickHouse/Neo4j self-hosted components

Facets

application · maturity active

security monitoring alerting agent-framework search-engine analytics self-hosted cli security artificial-intelligence monitoring developer-tools self-hosted python cli cross-platform soc siem soar alert-triage incident-response mitre-attack purple-team threat-intelligence detection-engineering agentic-ai clickhouse neo4j langgraph ai-agents docker web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="beenuar/AiSOC")