What problem it solves

Security teams need to normalize heterogeneous telemetry, detect and correlate threats, investigate incidents, and prepare responses while retaining an auditable record of each agent step. These workflows also require explicit controls so that response actions are not sent to vendors without human approval.

Key features

• Telemetry ingestion and detection — Normalize incoming security telemetry into a common event shape, apply executable detection rules and tenant-specific tuning, and turn matching results into alerts.

  Source: README

• AI triage and incident investigation — Use AI agents to triage alerts and investigate correlated incidents through typed tools, with grounding checks that route unsupported verdicts to human review.

  Source: README

• Replayable investigation ledger — Record prompts, tool calls, citations, verdicts and token costs in an Investigation Ledger, and export investigations as signed evidence bundles.

  Source: README

• Human-governed response workflows — Preview alert-triggered playbooks before action, enforce approval gates, and persist pauses so approved or expired runs retain an auditable outcome.

  Source: README

• Self-hosted local operation — Run the core stack without hosted-provider credentials by using a local model through the included gateway, with additional deployment profiles for event-lake, graph and search services.

  Source: README

Quick start

Copied verbatim from the project's README.

git clone https://github.com/beenuar/AiSOC && cd AiSOC
make up

$ make smoke
[PASS] raw telemetry accepted by ingest
[PASS] event traversed the spine and became an alert
PASS: 10/10 stages

Who it may suit

Inference: may suit security operations teams that need self-hosted telemetry correlation, AI-assisted triage, incident investigation, and human-governed response workflows.

Topics to discuss

• How should AI agent verdicts be evaluated across different alert types and investigation contexts?

• Which connectors and detection rules should the community prioritize for additional verification or migration support?

• How can teams balance automated investigation with durable human approval and response controls?

Written by ReadmeX AI from the project's README, source and public GitHub data; it may contain mistakes.

Read the original README https://github.com/beenuar/AiSOC#readme

ReadmeX opened this community for a trending project; it is not run by the project. Maintainers can claim it from the community page.