Open-Source AiSOC Launches to Automate Threat Triage With Auditable AI Agents

Security engineering teams often struggle with high volumes of telemetry data, leading to alert fatigue and delayed incident response. AiSOC is an open-source, self-hostable Security Operations Center designed to address these challenges through automated alert fusion, LLM-agent triage, and a transparent decision ledger.

Core Architecture and Capabilities

Unlike traditional cloud-locked security platforms, AiSOC runs locally or on private infrastructure without requiring external API keys. Its architecture is built around several distinct components:

• Telemetry Ingestion: Collects logs from major cloud and enterprise tools through dedicated connectors, applying vendor-specific normalization.
• Detection and Fusion: Runs thousands of executable detection rules alongside sliding-window rules to filter routine noise and correlate related security events.
• Auditable AI Agents: Employs local large language models (such as a bundled, CPU-friendly instruction model) to investigate alerts, query logs safely using typed tools, and propose response steps.
• Decision Ledger: Records every prompt, tool call, and citation, producing a verifiable audit trail and supporting signed evidence bundle exports.

Deployment and Practical Usage

AiSOC provides multiple ways to evaluate and run the system depending on local infrastructure constraints:

• Docker Compose: Requires Docker Compose v2, 8 GB of memory, and 20 GB of free disk space in the Docker VM.
• Offline Sandbox: A Python package (`aisoc-sandbox`) allows administrators to walk a sample alert through the agent funnel offline in under 30 seconds.
• Cloud Development: The repository can be opened directly in GitHub Codespaces for immediate terminal access.

Security and Human-in-the-Loop Controls

Automation within AiSOC operates under strict boundaries to prevent unauthorized actions. Response playbooks preview their execution plans before running, and default policies require explicit human approval for any active remediation. Furthermore, sensitive data handling relies on strict schema validation, ensuring raw logs or secrets are never improperly exposed to model prompts.

To verify the installation and operational health, operators can utilize diagnostic commands such as `make doctor` to inspect host environments, memory availability, and datastore connectivity.