#99th of 19 in Security
aisoc
Self-hosted SOC that detects threats and investigates alerts with auditable AI agents
- Stars
- 7.2k
- License
- MIT
- Last commit
- Nov 2026
- Last release
- Nov 2026
- Language
- Python
259 on 27 Apr 20267,248 on 9 Nov 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
AiSOC ingests security telemetry through 91 connectors and four cloud collectors, runs 2966 executable detection rules, correlates alerts into incidents, and has AI agents triage them. Every prompt and tool call goes to an Investigation Ledger that exports as a signed bundle, and response actions need human approval. The core stack bundles a local llama3.2:3b model via Ollama and runs on Kafka, Postgres, Redis and Qdrant.
Who it is for: Security teams self-hosting an AI-assisted SOC with human-approved response
Strengths
- Every agent prompt, tool call and citation is logged and exports as a signed evidence bundle
- Ships a local model, so triage works with no API key or hosted provider
- Response actions and playbooks default to preview and need a separate approver
- Detection rules count as executable only after replay proves they fire
Weaknesses
- Heavy stack: 16 services and about 8 GB RAM for core, about 12 GB for full
- No hosted LLM provider has been tested; bundled 3B model is not frontier-class
- Event lake, entity graph and full-text search need the larger full profile
- Splunk rule migration is mostly partial: 1,711 of 1,734 translated rules
What it needs
- RAM ≥ 8 GB
- GPU optional
- Compose
- Needs Docker Compose v2, Kafka, Postgres, Redis, Qdrant, Ollama, ClickHouse (full), Neo4j (full), OpenSearch (full)
- Models: Ollama llama3.2:3b-instruct-q4_K_M (bundled), Local OpenAI-compatible endpoints, Custom providers via console
What changed
- v23.1.0 ↗ (opens in a new tab)Security fix
“The Splunk connector validates the operator-supplied index= token”
“DeploymentConfig and DeploymentConfigUpdate drop the self-update”
GHSA-HRC5-W9R3-2G8R, GHSA-GHPM-VC6J-HP5R, GHSA-CVFR-9R25-GQPF, GHSA-QP9F-459J-W89C, GHSA-9Q6P-M345-H3HJ. “404 and 403 are no longer one branch, here or anywhere else in the connector tree. A 403 on audit events is the token not owning the group or the plan not including them, and stays an info line; a 40…”
From the release notes. No flag means the note does not say so, not that the upgrade is safe.
Quick answers
Is aisoc open source?
Yes. Its code is on GitHub under the MIT license.
Can you run aisoc with Docker?
Yes. Its repository has a Docker setup: a Dockerfile, a Compose file or a published image.
Does aisoc need a GPU?
No. It runs on a CPU and can use a GPU when you have one. Plan for at least 8 GB of RAM.
Also in Security
See all 19| Rank | Project | Score |
|---|---|---|
| 1 | shannonAutonomous pentester that exploits web apps and APIs using source analysis | 91 out of 100 |
| 2 | ifixaiPython CLI that audits AI agents for policy, access and reliability failures | 87 out of 100 |
| 3 | StrixAutonomous AI pentesting agents that validate vulnerabilities with working exploits | 84 out of 100 |
| #4 | pentagiAutonomous multi-agent penetration testing system with sandboxed security tools | 77 out of 100 |
| #5 | ai-infra-guardRed-teaming platform for AI infra CVEs, MCP servers, agent skills and jailbreaks | 75 out of 100 |