AiSOC — проект с открытым исходным кодом из категории «ИИ-агенты» от beenuar (beenuar/AiSOC на GitHub). У него 2 389 звёзд на GitHub и 267 форков, он распространяется по лицензии MIT и последний раз обновлялся на GitHub 8 октября 2026.
Open-source AI SOC — alert fusion, LLM triage, MITRE ATT&CK investigation and a replayable decision ledger
Decide your profile: core for the full alerting pipeline, full for the event lake/entity graph/hunting, or demo to explore with labelled synthetic data.
Clone the repo; you need Docker Compose v2 (8 GB memory, 20 GB disk in the Docker VM), python3 and bash — make doctor checks all of it.
Run make up: it creates .env with generated secrets, creates an administrator and prints its one-time password and the console address.
Run make smoke to watch one event travel ingest → detection → correlation → alert, then connect real data via the ingest API token or one of the click-and-connect connectors in Settings.
A large rule library (the README counts 6,991 rules on disk, 2,603 of them executable after replay proof) with your tenant's own tuning applied, grouping related alerts into incidents.
Agents read the alert, correlated siblings, entity context and prior verdicts, call typed tools (never raw SQL), and log prompts, tool calls, citations, verdict and token cost to the Investigation Ledger, exportable as a signed evidence bundle.
Playbooks preview before acting, three switches must agree before autonomy, approvals are durable pauses that survive restarts, and no vendor is touched without a human unless a tenant explicitly grants it.
A pinned ~2 GB local model (llama3.2:3b via Ollama) ships with the gateway and produces real triage verdicts; the CISA KEV threat feed also works key-free.
84 click-and-connect connectors (Splunk, Sentinel, Elastic, CrowdStrike, Okta, AWS, Kubernetes among them) plus an ingest API, and a migrate package that translates Splunk SPL / Sentinel KQL / Elastic EQL — refusing rather than approximating what it cannot carry.
New threat intelligence re-sweeps your collected history, hypotheses become hunts without hand-written queries, and an MCP server exposes AiSOC to Claude, Cursor and Continue.
Clone AiSOC and enter the directory.
git clone https://github.com/beenuar/AiSOC.git
cd AiSOCmake up creates .env and its generated secrets, creates an admin and prints its password once, and prints the console sign-in address.
make upmake smoke posts one real event and follows it through Kafka, detection, correlation and Postgres, reporting PASS/FAIL per stage; sign in and optionally load sample data from the setup wizard.
make smokebeenuar maintains it; the docs and technical guide are linked from the repo and at beenuar.github.io/AiSOC.
Yes, MIT-licensed and self-hostable.
No — the README emphasizes it runs with no API keys: triage uses the bundled local model, and you may optionally connect your own provider from the console.
Commercial platforms bring vendor scale and support. AiSOC is open and self-hosted, with agent triage and a replayable decision ledger as first-class features — and unusually explicit documentation of which capabilities are proven versus not.
Clone, run make up, save the printed admin password, run make smoke, and load sample data from the setup wizard.
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fr…
Tradememory-protocol — decision audit trail + persistent memory for ai trading, open-so...
ByteDance's SandboxFusion: a secure sandbox for running and judging LLM-generated code in 20+ languages.
A self-healing harness that connects an LLM directly to your real browser
Supercharge LLM app evaluations with objective metrics, synthetic test data and feedback loops.
Scan your LLM for vulnerabilities before attackers do.
Другие проекты из категории «ИИ-агенты» с наибольшим числом звёзд в каталоге LibreAI — реалистичный список альтернатив, если AiSOC вам не подходит.
A personal AI that really does things — on any OS, with your data staying yours.
An agentic skills framework & software development methodology that works.
Agent harness optimization system with skills, memory and security for Claude Code, Codex and more
The agent that grows with you — a Python framework for adaptive AI agents.
DeepSeek's plugin-based agent harness where everything is a plugin.
Соседние проекты из категории «ИИ-агенты» в каталоге, ближайшие по числу звёзд к AiSOC — продолжайте изучать полку по обе стороны от него.
Native MCP plugin for x64dbg — let an AI drive the debugger: breakpoints, stepping, memory, registers
Pinvou Agent — open-source desktop AI agent for tools, files, knowledge, workflows and real deliverables
ESP32 iPhone Agent — let an AI model use a real iPhone with a $7 ESP32: AirPlay eyes, USB HID hands, no computer, no jailbreak
Google's modular toolkit that lets AI coding agents hunt, reproduce, and patch vulnerabilities autonomously.
Use LLMs as plain Python functions: prompts become typed, testable code.
Open-source Computer Use as an MCP service: let any agent drive macOS, Linux, and Windows desktops.
Бесплатно и открыто — забирайте исходный код, ставьте звезду репозиторию и начинайте создавать.