AiSOC runs 2,534 of its 7,015 security rules as executable detections, then hands each incident to an auditable AI agent
Synopsis
The open-source, self-hostable AiSOC normalizes security telemetry, runs the 2,534 executable rules of its 7,015-rule library, groups what fires into incidents, and has an AI agent investigate each one and propose a response. Every prompt and tool call is recorded, and a human approves before anything reaches a vendor. New threat intelligence re-sweeps the history already collected.
Interpretation
A security operations center's core loop is packaged as one self-hostable open-source system: telemetry ingestion, rule detection, incident grouping, AI investigation and proposed response, with a person approving the last step. Previously security tools emitted separate alerts that analysts read and correlated by hand; AiSOC puts normalization, detection, grouping and investigation into a single self-hosted deployment. The stated check is make smoke: one real event is posted to the ingest API and followed through Kafka, detection, correlation and Postgres, then read back from the public API, with ten stages each reporting PASS or FAIL.
The AI agent's investigation is auditable step by step, because every prompt and tool call is recorded, so a verdict traces back to specific inputs and actions. Conventional alert automation keeps only the final decision, leaving the intermediate reasoning invisible; here prompts and tool calls are retained alongside it. That auditability applies to each incident's own investigation, and a proposed action still needs human approval before it reaches a vendor tool.
Incoming threat intelligence re-sweeps telemetry already collected, so earlier data is examined again under the new intelligence. In a usual workflow an intelligence update affects only data arriving afterward, and history must be revisited separately. The behavior is described as built into the system, on the same processing path as rule detection, incident grouping and agent investigation.
Perspective
The demonstrated scope is a self-hosted deployment requiring Docker Compose v2, 8 GB of memory and 20 GB of free disk in the Docker VM, plus python3 3.9 or later and bash, with a first run that downloads a roughly 2 GB model into a volume. The demo and smoke test cover the path from ingestion to reading an alert back, plus five sample scenarios spanning low to critical severity.
The public material covers installation, the smoke test and demo scenarios, and reports no detection accuracy, false-positive rate or comparison with other security-operations offerings. The sample scenarios are deliberately spread from low to critical severity and do not mark a tenant's setup as complete.