AiSOC runs 2,538 of its 7,023 detection rules and hands each incident to an auditable AI agent, with a human approving every response
Synopsis
AiSOC is an open-source, self-hostable security operations center that normalizes incoming telemetry, detects with the 2,538 executable rules of its 7,023-rule library, groups what fires into incidents, and has an AI agent investigate each one with every prompt and tool call recorded. Proposed responses reach a vendor only after a human approves, and new threat intelligence re-sweeps the history already collected. The project documents a single-server run from install to AI verdict, and notes a roughly 2 GB model download on first run.
Interpretation
The core loop of a security operations center now sits in a self-hostable open-source system: telemetry is normalized, checked against rules, grouped into incidents, then investigated by an AI agent that proposes an action for human approval. This correlation and investigation work has typically been carried by vendor-hosted commercial platforms, with detection logic and agent reasoning not visible to the operator. The project documents a single-server run from install to AI verdict against its published images, with shortened terminal waits marked on screen in the recording.
Detection runs the executable part of the rule library rather than the whole library. The library holds 7,023 rules, and 2,538 of them are executable and run. Rules that fire are grouped into incidents, and each incident is investigated by an AI agent whose prompts and tool calls are all recorded.
New threat intelligence is re-applied to telemetry already collected, and a person stands before any action. Fresh intelligence re-sweeps existing history instead of applying only to telemetry that arrives afterward. Any response requires human approval before it reaches a vendor.
Perspective
The demonstrated scope is a single-server run against published images, from installation to an AI verdict; the first run downloads a roughly 2 GB model into a volume that only make clean clears. The environment requires Docker Compose v2, 8 GB memory, 20 GB free disk, python3 3.9+ and bash.
The project states that its demonstration recording is older than the stills from the v20.1.0 run, which were taken under the same rules. Sample data is attributed to AiSOC in the source column, refuses to load into a tenant that already has real alerts, and does not mark setup complete.