AiSOC
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
- agentic-ai
- ai-security
- alert-triage
- blue-team
- cybersecurity
- detection-engineering
- incident-response
- langgraph
- llm-agents
- mcp
- mitre-attack
- model-context-protocol
- purple-team
- security-operations
- self-hosted
- siem
- soar
- soc
- threat-detection
- threat-intelligence
- Stars
- 3,977
- Forks
- 398
- + today
- +2
- Created
- 5mo
Ranking data as of October 26, 2026 (UTC).
Star History
Today, hour by hour
Overview
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue. It ranks #144 on GitTiger, gaining +2 stars on October 26, 2026 (UTC).
The project is written in Python and has 398 forks. It was created 5mo ago.
What it is
`beenuar/AiSOC` is an open-source security operations platform built around language-model agents. The description presents it as a SOC you can self-host: telemetry flows in, alerts are grouped, agents investigate, and a person decides what happens next. It is Python, released under the MIT licence, and the description says it runs without any API keys.
Documented capabilities
- **Alert fusion.** Separate detections are merged into single incidents instead of being left as a flat queue. - **Agent triage.** Model-driven agents work each incident, and their reasoning is recorded rather than hidden. - **Framework mapping.** Investigations are tied to MITRE ATT&CK; topics also mention incident response, LangGraph and LLM agents. - **Replayable decisions.** Every agent step lands in a ledger that can be replayed, which is what makes the trail auditable. - **Human approval.** Responses are proposed rather than executed automatically, so a person signs off. - **MCP server.** The description says a Model Context Protocol server ships for Claude, Cursor and Continue.
Getting started
The README preview points at a three-minute recorded walkthrough and stills from a version 20.1.0 run, but carries no install commands, configuration keys or system requirements. Deployment instructions belong in the README.
Not established here
The evidence names no supported telemetry sources or deployment targets, does not explain the no-key mode, and offers no detection-quality benchmarks.
git clone https://github.com/beenuar/AiSOC.git
cd AiSOC
# see README for setupFrequently Asked Questions
Does AiSOC need cloud API keys to run?
The description says it can be operated with no API keys at all, which is what makes a local or isolated evaluation possible. The evidence does not explain how model access works in that mode.
What makes the agent investigations auditable?
Every step an agent takes is written to a decision ledger that can be replayed, so an analyst can reconstruct how a verdict was reached after the fact.
Are response actions applied automatically?
No. The platform proposes response actions and expects a human to approve them, keeping a person in the loop before anything changes in the environment.
Which assistants can connect through the MCP server?
The description names Claude, Cursor and Continue as clients for the bundled Model Context Protocol server.