AiSOC

AiSOC is an open-source AI Security Operations Center that ingests telemetry, detects threats, and investigates with AI agents.

AiSOC is an open-source, self-hostable AI Security Operations Center designed for security teams. It ingests security telemetry, runs detection rules, groups alerts into incidents, and investigates them using AI agents with fully auditable reasoning steps. The platform normalizes data, applies executable rules, and proposes responses that require human approval before execution. It includes a bundled local model for triage, a CISA KEV threat intelligence feed, and support for numerous click-and-connect data connectors. The system stands out by providing an investigation ledger that records every prompt, tool call, and decision for complete transparency.

AiSOC at a glance

Best for: Software engineer
Runs on: self-hosted, open source, API, Docker
Pricing: Free open-source software
Released: May 2026
Category: AI coding tool
Website: github.com/beenuar/AiSOC

Key features

Ingests security telemetry from multiple sources
Runs executable detection rules and correlates threats
Investigates incidents with AI agents and logs reasoning
Proposes response actions for human approval
Provides a local model for triage without API keys
Integrates the CISA KEV threat intelligence catalog
Exports signed evidence bundles in OCSF format

Use it for

Detect and correlate security threats from telemetry
Triage alerts automatically using local AI models
Investigate incidents with auditable AI reasoning ledgers
Ingest and normalize data from various security connectors

Alternatives to AiSOC

ARTEX — Runs autonomous multi-agent penetration testing with a dual-graph architecture.
ODS — Automates complex local AI infrastructure setups with one command.
New Relic — Unified visibility across applications, infrastructure, and AI models.
HackerOne — Combines AI agents with expert human researchers to prioritize and fix real risks.
CyberStrike — Autonomous AI agents execute recon, web, network, and cloud penetration testing.
DeepSource — Automated code reviews that combine static analysis with AI agents.
Mantis — Automates vulnerability discovery and patching using AI agents.
Vigil — Drives end-to-end security engagements with specialist agents and a shared Kali container.
AIOps — It provides 3D spatial topology visualization and human-in-the-loop safety controls.
Datadog — Consolidates observability and security data in one unified platform.
Composio — Equips AI agents with tools, managed user auth, and sandboxes across 1,500+ apps
Deepsec — Runs security reviews on all existing code using scaled VM fanout.

All AiSOC alternatives