23 Daily — AiSOC is an open-source, self-hosted AI Security Operations Center system that integrates alert fusion, large language model (LLM) agent triage, and MITRE ATT&CK framework investigation capabilities. Developed by the GitHub project beenuar / AiSOC, it reached GitHub Trending on November 1, 2026, with over 6,000 stars, according to the project's description.
End-to-End Automated Threat Detection and Investigation
AiSOC ingests telemetry data from various security tools, normalizes it, and applies 2,534 executable rules from a library of 7,015 rules to detect and correlate events. Each incident is investigated by AI agents following the MITRE ATT&CK framework. Every prompt and tool call the AI agent makes is recorded for fully replayable auditing, ensuring transparency and trust. The system proposes response actions, which require human approval before execution, enhancing risk management accuracy for enterprises.
Wide-ranging Data Sources and Flexible Deployment
It supports 87+ click-and-connect data connectors including Splunk, Microsoft Sentinel, Elastic, CrowdStrike, Okta, AWS, and Kubernetes, featuring vendor-specific normalization and setup documentation. Data collectors cover AWS S3 with SQS notification, Google Pub/Sub, Azure Event Hubs, and syslog/CEF. Each collector supports resumable cursors and bounded poll budgets to prevent overload. AiSOC runs fully self-hosted with no API keys needed, leveraging local language models for offline event processing. Deployment requires Docker Compose v2, 8GB RAM, and 20GB free disk space. Installation is simplified to a one-line command.
Operational Validation and User Experience
Built-in validation commands like 'make smoke' and 'make demo' verify the pipeline from event ingestion through Kafka, detection, correlation, database storage, and API retrieval. First-time login prompts users with a setup wizard to load sample data demonstrating event severity levels and AI triage. The administrator password is generated locally and displayed only once for security. The console UI presents alert details transparently, including raw event data and AI decision rationale.
Editor's take: Implications and Validation Opportunities for Security Startups
AiSOC exemplifies automating and open-sourcing complex security monitoring and investigation workflows, establishing trust via auditable AI agents, and breaking the cost and manpower constraints of traditional security operation centers. Entrepreneurs can adopt such an open approach and self-host model to reduce customer onboarding barriers, especially for SMEs or organizations valuing data sovereignty. Validations are feasible by deploying AiSOC in testing environments, utilizing built-in test commands and diverse data feeds to simulate real attack scenarios. This allows evaluation of alert accuracy, AI triage effectiveness, and integration capabilities with existing security tools, revealing the solution's extensibility and practical value.