Verified project record

beenuar/AiSOC

AiSOC is a self-hostable AI Security Operations Center that runs with no API keys and records every agent step in a replayable decision ledger. It normalizes security telemetry, runs 2966 executable detection rules, groups firings into incidents, and has an AI agent investigate each incident with human approval of proposed actions.

Project overview

It combines a full local detection pipeline with auditable AI triage — every prompt and tool call is recorded — while shipping a local ~2 GB llama3.2 model sized for CPU-only inference and polling the CISA KEV catalog with no API key, so no paid service is required to run it.

Project type: MCP · AI Agent
Use cases: Automation
Deployment: Refer to project documentation
License: MIT

Best for

Operations teams that need to normalize security telemetry, correlate threats into incidents, and triage alerts with AI agents whose reasoning is fully auditable.
Teams that need a self-hosted setup running with no API keys and no paid service, using a bundled local model.

Key capabilities

Normalizes security telemetry, runs 2966 executable detection rules, and groups what fires into incidents.
An AI agent investigates each incident with every prompt and tool call recorded, and proposes an action a human approves.
Polls the CISA Known Exploited Vulnerabilities catalog with no API key, and new threat intelligence re-sweeps collected history.

Limitations and risks

Not a drop-in SIEM replacement; it does not replace long-term log retention and compliance search.
The three npm packages still need the first-upload NPM_TOKEN, an account action.

Getting started

Quick start is three commands ending in a signed-in console: git clone https://github.com/beenuar/aisoc && cd AiSOC, then make up, then sign in at the printed address. No coding is required.

Evidence and sources

GitHub project description: Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
README: **An open-source, self-hostable AI Security Operations Center.** It ingests your security telemetry, detects and correlates threats, investigates them with AI agents whose reasoni…
GitHub project description: a replayable decision ledger for every agent step
README: runs the 2966 executable rules of its 7407-rule library, groups what fires into incidents, investigates each one with an AI agent whose every prompt and tool call is recorded, and…
README: `services/threatintel` polls the CISA Known Exploited Vulnerabilities catalog — public, no API key

Source updated at: 2026-11-03T18:23:24Z

Open original GitHub project