AiSOC: an open-source, self-hostable AI security operations center
The AiSOC project README describes an MIT-licensed, self-hostable security operations platform that normalizes telemetry, runs the 2538 executable rules of its 7023-rule library, groups hits into incidents, investigates them with AI agents whose prompts and tool calls are recorded, and proposes actions for human approval. Its smallest "core" deployment runs with no API keys and ships a local Ollama-served llama3.2:3b model plus the CISA KEV threat feed, while an MCP server supports Claude, Cursor and Continue. The README states AiSOC is not a drop-in SIEM replacement, cannot see telemetry that has not been connected, and is not autonomous by default; it also notes that demo incidents are synthetic and published benchmark numbers are substrate self-consistency measures rather than live agent accuracy. Deployment requires Docker Compose v2 with about 8 GB of memory and 20 GB of free disk in the Docker VM. The project says development is funded and supported by Cyble, which releases it under the MIT licence with no gated modules or telemetry.
The project combines local-model agent analysis, recorded investigation steps with citable ledger entries, and human-approved responses in an MIT-licensed self-hosted release. Its capability and benchmark claims come from the project's own README and are qualified there as self-consistency measures, so they remain unverified independently.
This source is a digest of several news items (“beenuar/AiSOC”). Find this story in the original.
#AiSOC#Cyble#MITRE ATT&CK#Claude#Cursor#Continue#Ollama#CISA KEV