AiSOC

Headlines · 1

1. 5h
   AiSOC: an open-source, self-hostable AI security operations center

   The AiSOC project README describes an MIT-licensed, self-hostable security operations platform that normalizes telemetry, runs the 2538 executable rules of its 7023-rule library, groups hits into incidents, investigates them with AI agents whose prompts and tool calls are recorded, and proposes actions for human approval. Its smallest "core" deployment runs with no API keys and ships a local Ollama-served llama3.2:3b model plus the CISA KEV threat feed, while an MCP server supports Claude, Cursor and Continue. The README states AiSOC is not a drop-in SIEM replacement, cannot see telemetry that has not been connected, and is not autonomous by default; it also notes that demo incidents are synthetic and published benchmark numbers are substrate self-consistency measures rather than live agent accuracy. Deployment requires Docker Compose v2 with about 8 GB of memory and 20 GB of free disk in the Docker VM. The project says development is funded and supported by Cyble, which releases it under the MIT licence with no gated modules or telemetry.

   GitHub Trending（每日） · 🔥 10

Experience and discussion from the community

Share my AiSOC experienceAsk about AiSOC