AiSOC is an open-source, self-hostable AI Security Operations Center with 5,855 stars on GitHub. It ingests security telemetry, detects and correlates threats, and investigates each incident with LLM agents whose reasoning is fully recorded in a replayable decision ledger.
AiSOC turns the flood of security alerts into a manageable investigation workflow. Telemetry arrives from 87 click-and-connect data connectors, including Splunk, Sentinel, Elastic, CrowdStrike, Okta, AWS, and Kubernetes audit logs, or through a push ingest API. A detection engine runs 2,530 executable rules from a 7,015-rule library, groups what fires into incidents, and hands each one to an AI agent for triage. Every prompt, tool call, citation, verdict, and token cost is written to the Investigation Ledger, and investigations can be exported as signed evidence bundles. A human approves every response action before anything reaches a vendor, so autonomy is granted explicitly, never assumed. The whole stack runs on your own hardware with Docker Compose, and the core deployment needs no API keys at all: a bundled local model handles triage, and the one live external feed, the CISA Known Exploited Vulnerabilities catalog, is public.
AiSOC is completely free and open source under the MIT license. There is no hosted paid tier; you run the full stack on your own infrastructure, and the bundled local model means triage works without purchasing model API credits.
AiSOC is built for security teams and blue teams that want an AI-assisted SOC without sending telemetry to a vendor cloud. It suits analysts drowning in alerts, detection engineers who want a provable rule library, and self-hosters who value auditability, since every AI verdict carries its receipts and can be replayed and challenged.