AI BriefingAiSOC: Open-source AI SOC that runs without an API key
beenuar/AiSOC
About the project
An open-source AI security operations center that collects security telemetry to detect threats and perform correlation analysis. It groups events into incidents using 2,538 executable rules from a library of 7,023 rules. All processing is performed locally, requiring no external API keys.
An AI agent investigates each incident, logging all prompts and tool calls used. Investigations are based on the MITRE ATT&CK framework, and the agent's reasoning process is designed to be fully auditable. Final response actions must be approved by a human before being passed to vendor systems.
Within minutes of startup, it loads real-world threat intelligence, such as the CISA KEV catalog, and rescans previously collected data. It also provides an MCP server that integrates with various development environments, including Claude, Cursor, and Continue. It is distributed under the MIT license and can run in a Docker Compose environment with just 8GB of memory and 20GB of disk space.
It is suitable for security engineers who want to replicate the features of existing commercial SIEM or SOAR solutions in a self-hosted environment. The primary target audience is teams that want to transparently verify the basis of the agent's decisions or introduce AI-based triage while maintaining data sovereignty.
beenuar/AiSOC
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
Python
This introduction was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report errors, attribution issues, or removal requests via Contact.