AiSOC
Self-hostable AI security operations stack that correlates alerts and logs agent investigation steps in real time.
Autonomous alert triage, graph-based investigation, and step-by-step LLM audit trails on your infra.
AiSOC is an open-source security operations stack designed to automate incident triage and threat investigation using AI agents. It ingests raw security telemetry, correlates events, and runs autonomous investigations while writing every decision step to an auditable ledger. Security operations teams and detection engineers should use it to reduce alert noise without sending unredacted data to proprietary clouds.
What it is
The platform ingests security events and processes them through a deterministic scoring engine alongside a LangGraph-powered orchestrator. It records every LLM prompt, evidence artifact, tool invocation, and decision path into a replayable Investigation Ledger. It includes a built-in telemetry evaluation harness in CI and supports both local models like Ollama or vLLM and hosted models with automated evidence pseudonymization.
Who it's for
This tool suits SOC teams, purple teams, and detection engineers who need transparent, automated incident response on self-managed infrastructure. It is not suitable for small teams looking for a zero-maintenance SaaS product, as running the complete orchestration stack requires administering multiple backend services.
Key features
Auditable Investigation Ledger
Logs every prompt, LLM response, cited evidence item, and tool invocation step-by-step for complete replay capability.
Perimeter Data Protection
Automatically pseudonymizes internal IPs, hostnames, and credentials before sending evidence to cloud LLMs, or runs fully air-gapped via local models.
Lightweight Sandbox Engine
Provides an in-memory, zero-dependency simulator to execute triage scenarios offline in under five seconds without external API keys.
Continuous Substrate Evaluation
Gates code changes against synthetic telemetry suites and deterministic incident templates in continuous integration.
Up and running in 3 steps
Our honest verdict
What's great
- Complete visibility into AI decision-making via the replayable Investigation Ledger
- Support for fully air-gapped deployments using Ollama or vLLM backends
- Zero-dependency sandbox CLI for rapid offline testing and scenario dry-runs
- Built-in CI evaluation harness to benchmark alert reduction against fixed datasets
Where it falls short
- Full deployment requires managing complex backend services like PostgreSQL, Redis, and Kafka
- Requires ongoing operational effort to maintain database cluster health and telemetry pipelines
- Cloud model integrations demand strict verification of data pseudonymization rules
Pricing & license
AiSOC is completely free software under its open-source license. There are no paid tier upgrades mentioned; your only expense is the compute and storage infrastructure required to host the services and any API fees for third-party LLM providers.
Open remote AI-training roles
880 open remote AI-training roles, updated November 15, 2026; most pay $20–$175 an hour. Zekai lists them free; the application goes to the employer’s platform.
Alternatives
These reviewed AI tools do the same job instantly — from our scored directory.
Use it, or have us set it up
FAQ
Can I run AiSOC completely offline?
Yes, you can run AiSOC in a fully air-gapped environment by connecting the agent orchestrator to local model providers such as Ollama or vLLM.
How does AiSOC prevent sensitive telemetry from leaking to cloud LLMs?
When configured with external LLM providers, AiSOC pseudonymizes hostnames, IP addresses, emails, secrets, and file paths into opaque tokens before transmission.
What data storage services are required for production?
A full production installation requires PostgreSQL, Redis, Kafka, ClickHouse, and Neo4j to manage telemetry ingestion, message queues, and graph investigations.
