beenuar/AiSOC

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

Open original source ↗

From the publisher

README & documentation

Source preview

Read the project’s overview, installation instructions and usage examples. The original README is the source of truth.

An open-source, self-hostable AI Security Operations Center. It ingests your security telemetry, detects and correlates threats, investigates them with AI agents whose reasoning is fully auditable, and proposes responses a human approves. [](https://opensource.org/licenses/MIT) [](CHANGELOG.md) [](https://github.com/beenuar/AiSOC/actions/workflows/ci.yml) [](https://github.com/beenuar/AiSOC/actions/workflows/codeql.yml) [](https://securityscorecards.dev/viewer/?uri=github.com/beenuar/AiSOC) [](https://raw.githubusercontent.com/beenuar/AiSOC/main/apps/web/public/papers/aisoc-technical-guide.pdf) Technical Guide (PDF) · Docs · Architecture · What actually works · Discussions Telemetry arrives from your security tools. AiSOC normalizes it, runs the 2530 executable rules of its 7015-rule library, groups what fires into incidents, investigates each one with an AI agent whose every prompt and tool call is recorded, and proposes an action. New threat intelligence re-sweeps the history you already collected, and a human approves before anything reaches a vendor. Watch the full three minutes — install to AI verdict on one server against the published images, terminal waits shortened and the recording saying so on screen. The stills below are from a v20.1.0 run under the same rules…

beenuar/AiSOC on GitHub A short preview, not the full document.

Read the full README ↗ · Preview checked 2026-11-01T14:01:20.002Z

Inside the original README — Document outline

Headings are captured from the source. Links open the publisher’s document, not a locally hosted copy.

Links from the README

References supplied by the publisher, not independently verified endorsements. Check the destination before downloading files or entering credentials.

Documentation belongs to its respective authors. Reported project/model license: MIT. A listing is not a grant of reuse or training rights. Confirm the document’s own terms at the source.

What this repository does

Repository facts

Owner: beenuar
Primary language: Python
Stars: 5,866
Forks: 616
Open issues + pull requests: 16
License: MIT
Archived: No
Default branch: main
Created: 2026-05-02T03:30:19.000Z
Last push: 2026-11-01T12:14:24.000Z

Topics and intended use

Owner-supplied topics: agentic-ai, ai-security, alert-triage, blue-team, cybersecurity, detection-engineering, incident-response, langgraph, llm-agents, mcp, mitre-attack, model-context-protocol, purple-team, security-operations, self-hosted, siem, soar, soc, threat-detection, threat-intelligence

Review the README for scope, installation, examples and limitations. We do not run repository code or certify it.

Evaluate before installing

Review licensing and dependencies, inspect recent commits and unresolved issues, and test in an isolated environment before production use. Stars and forks alone cannot answer these questions.

README and project files

Issues and maintenance discussion

Releases and changelog

Source and freshness

Source: GitHub. Metadata observed 2026-11-01T12:14:42.611Z. Daily imports are snapshots, not real-time monitoring.

Popularity and source listings do not establish security, suitability, licensing rights or benchmark performance.

Open original source

Related repositories

public-apis/public-apis

EbookFoundation/free-programming-books

donnemartin/system-design-primer

vinta/awesome-python

practical-tutorials/project-based-learning

NousResearch/hermes-agent