What AiSOC does
AiSOC collects security telemetry, converts incoming events into a common format, applies detection logic, and groups matching findings into incidents. Its rule library contains 7,015 rules, with 2,535 currently executable according to the project description. The resulting alerts retain attribution to the connector that supplied them.
AI agents investigate incidents and produce a verdict, confidence level, rationale, and proposed response. Every prompt and tool call is recorded, creating a replayable decision ledger for review. Human approval is required before a proposed action is sent to an external vendor.
The platform also includes threat-intelligence workflows. New intelligence can be applied to previously collected data, allowing historical telemetry to be rescanned rather than limiting analysis to newly arriving events. The project is intended for self-hosted security operations and belongs in a security-focused deployment where auditability matters.
How it works
Telemetry can arrive through the ingest API or through configured connectors. The pipeline normalizes events, evaluates detections, correlates matching activity, and stores the resulting alerts. The documented smoke test follows an event through ingest, Kafka, detection, correlation, and Postgres before reading the alert through the public API.
The platform supports both push and pull collection patterns. Its connector catalog includes vendor-specific profiles for systems such as Splunk, Sentinel, Elastic, CrowdStrike, Okta, AWS, and Kubernetes audit data. Cloud and infrastructure collection paths include CloudTrail through S3 and SQS, GCP Pub/Sub, Azure Event Hubs, and syslog/CEF. Collectors maintain resumable cursors and bounded polling budgets.
AiSOC also includes an MCP server for Claude, Cursor, and Continue, allowing those clients to work with the AiSOC environment through MCP.
Setup and configuration
The standard startup path is:
git clone https://github.com/beenuar/AiSOC
cd AiSOC
make up
The deployment uses Docker Compose v2 and expects at least 8 GB of memory and 20 GB of free disk in the Docker VM, along with Python 3.9 or newer and Bash. make doctor checks the local prerequisites. The initial run downloads an approximately 2 GB model into a volume.
make up creates the environment file, generates service and datastore secrets, creates an administrator, and prints the generated administrator password once. make bootstrap ARGS=--reset-password creates a replacement administrator password. make smoke validates the main event-processing path after startup.
For a local offline demonstration, pip install aisoc-sandbox && aisoc-sandbox demo walks an alert through the agent funnel. GitHub Codespaces is also supported as a place to run the stack.
Tools and capabilities
- Ingest security events through the API or configured connectors.
- Normalize telemetry from vendor-specific and generic sources.
- Run executable detection rules and correlate findings into incidents.
- Investigate incidents with AI-generated verdicts, confidence, and rationale.
- Record agent prompts and tool calls in a replayable ledger.
- Rescan historical telemetry when new threat intelligence arrives.
- Translate Splunk SPL, Sentinel KQL, and Elastic EQL detections when supported.
- Expose AiSOC capabilities through MCP for Claude, Cursor, and Continue.
Limitations and notes
AiSOC requires a substantial local runtime: Docker Compose v2, 8 GB of Docker VM memory, 20 GB of free disk, Python 3.9+, and Bash. The first startup downloads a large local model. Detection migration can produce partial translations; unsupported logic is rejected instead of approximated. Proposed responses remain subject to human approval before reaching a vendor.