AI Agents
Anthropic-Cybersecurity-Skills
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fr…
★ 33.8k starsApache-2.0
View guide →Open-source AI SOC — alert fusion, LLM triage, MITRE ATT&CK investigation and a replayable decision ledger
AiSOC is an open-source ai agents project by beenuar (beenuar/AiSOC on GitHub). It has 2,389 GitHub stars and 267 forks, is released under the MIT license, and was last updated on GitHub on 8 October 2026.
Decide your profile: core for the full alerting pipeline, full for the event lake/entity graph/hunting, or demo to explore with labelled synthetic data.
Clone the repo; you need Docker Compose v2 (8 GB memory, 20 GB disk in the Docker VM), python3 and bash — make doctor checks all of it.
Run make up: it creates .env with generated secrets, creates an administrator and prints its one-time password and the console address.
Run make smoke to watch one event travel ingest → detection → correlation → alert, then connect real data via the ingest API token or one of the click-and-connect connectors in Settings.
A large rule library (the README counts 6,991 rules on disk, 2,603 of them executable after replay proof) with your tenant's own tuning applied, grouping related alerts into incidents.
Agents read the alert, correlated siblings, entity context and prior verdicts, call typed tools (never raw SQL), and log prompts, tool calls, citations, verdict and token cost to the Investigation Ledger, exportable as a signed evidence bundle.
Playbooks preview before acting, three switches must agree before autonomy, approvals are durable pauses that survive restarts, and no vendor is touched without a human unless a tenant explicitly grants it.
A pinned ~2 GB local model (llama3.2:3b via Ollama) ships with the gateway and produces real triage verdicts; the CISA KEV threat feed also works key-free.
84 click-and-connect connectors (Splunk, Sentinel, Elastic, CrowdStrike, Okta, AWS, Kubernetes among them) plus an ingest API, and a migrate package that translates Splunk SPL / Sentinel KQL / Elastic EQL — refusing rather than approximating what it cannot carry.
New threat intelligence re-sweeps your collected history, hypotheses become hunts without hand-written queries, and an MCP server exposes AiSOC to Claude, Cursor and Continue.
Clone AiSOC and enter the directory.
git clone https://github.com/beenuar/AiSOC.git
cd AiSOCmake up creates .env and its generated secrets, creates an admin and prints its password once, and prints the console sign-in address.
make upmake smoke posts one real event and follows it through Kafka, detection, correlation and Postgres, reporting PASS/FAIL per stage; sign in and optionally load sample data from the setup wizard.
make smokebeenuar maintains it; the docs and technical guide are linked from the repo and at beenuar.github.io/AiSOC.
Yes, MIT-licensed and self-hostable.
No — the README emphasizes it runs with no API keys: triage uses the bundled local model, and you may optionally connect your own provider from the console.
Commercial platforms bring vendor scale and support. AiSOC is open and self-hosted, with agent triage and a replayable decision ledger as first-class features — and unusually explicit documentation of which capabilities are proven versus not.
Clone, run make up, save the printed admin password, run make smoke, and load sample data from the setup wizard.
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fr…
Tradememory-protocol — decision audit trail + persistent memory for ai trading, open-so...
ByteDance's SandboxFusion: a secure sandbox for running and judging LLM-generated code in 20+ languages.
A self-healing harness that connects an LLM directly to your real browser
Supercharge LLM app evaluations with objective metrics, synthetic test data and feedback loops.
Scan your LLM for vulnerabilities before attackers do.
The most-starred other AI Agents projects in the LibreAI catalogue — the realistic shortlist if AiSOC is not the right fit.
A personal AI that really does things — on any OS, with your data staying yours.
An agentic skills framework & software development methodology that works.
Agent harness optimization system with skills, memory and security for Claude Code, Codex and more
The agent that grows with you — a Python framework for adaptive AI agents.
DeepSeek's plugin-based agent harness where everything is a plugin.
Free and open — grab the source, star the repo, and start creating.