AiSOC
by beenuar
AiSOC is a self-hostable security operations centre that collects security logs, detects and groups threats into incidents, and uses AI agents to investigate them. Every agent step is recorded, and a human approves any response before it is sent on.
- Stars
- 6.8k
- Licence
- MIT
- Runs on
- A small server
- Setup
- Technical
- Language
- Python
- Age
- 185 days
What you can do with it
- Connect log sources such as Splunk, Okta, AWS or CrowdStrike and turn their alerts into grouped incidents
- Have AI agents triage and investigate alerts, with every prompt and tool call recorded for review
- Use the bundled MCP server to query and work with security data from Claude, Cursor or Continue
Make money with it
A freelance security consultant could host it for small clients and charge a monthly fee for monitoring and incident reviews.
An idea, not financial advice. Check the licence before charging for anything built on it.
Ways a business could use it
- Run in-house alert triage and incident tracking instead of paying for a commercial SIEM or SOAR licence
- Offer small clients a managed security monitoring service built on a self-hosted instance
Can you use it commercially?
Free to use, change and sell, including in paid products. Keep the copyright notice.
Not legal advice. Read the project's licence file before building a product on it.
Getting it running
Clone the repository and run `make up` with Docker Compose v2 (8 GB memory and 20 GB disk needed), or use the install script; a no-Docker `pip install aisoc-sandbox` demo is also available.
Follow the official instructions in the project README.
Things to check
- Heavy resource needs: 8 GB memory, 20 GB disk and a roughly 2 GB model download
- Security tooling needs careful setup and hardening before it is trusted with real telemetry
- Some connectors and better AI verdicts may depend on external vendor credentials or paid LLM keys
Who's talking about it
Checked 03 Nov 2026. Summary drafted by AI from the project's README.
