AiSOC
An open-source AI security operations center (SOC) project that uses LLM agents for alert fusion and triage. It supports investigation mapping to MITRE ATT&CK and a replayable decision ledger. Written in Python under the MIT license, it supports self-hosting and can run without an API key.
Timeline (last 90 days)
The beenuar/AiSOC project on GitHub is an open-source AI security operations center that integrates alert fusion, LLM agent triage, MITRE ATT&CK investigation, and a replayable decision ledger.
The AiSOC project has gained 5841 stars and 615 forks, with 436 new stars in a single day.
AiSOC is written in Python, is open-sourced under the MIT license, and supports self-hosted deployment.
AiSOC can run without an API Key.
AiSOC's alert fusion feature aggregates duplicate and related alerts from different security devices, reducing analysts' cognitive load.
AiSOC's triage stage is driven by LLM agents, which perform preliminary assessment and prioritization of alerts and map the investigation process to the MITRE ATT&CK framework.
Before adopting AiSOC in production environments, it is necessary to evaluate its coverage of alert sources and the accuracy of agent triage.
All Facts (7)
The beenuar/AiSOC project on GitHub is an open-source AI security operations center that integrates alert fusion, LLM agent triage, MITRE ATT&CK investigation, and a replayable decision ledger.
50%UnverifiedThe AiSOC project has gained 5841 stars and 615 forks, with 436 new stars in a single day.
50%UnverifiedAiSOC is written in Python, is open-sourced under the MIT license, and supports self-hosted deployment.
50%UnverifiedAiSOC can run without an API Key.
50%UnverifiedAiSOC's alert fusion feature aggregates duplicate and related alerts from different security devices, reducing analysts' cognitive load.
50%UnverifiedAiSOC's triage stage is driven by LLM agents, which perform preliminary assessment and prioritization of alerts and map the investigation process to the MITRE ATT&CK framework.
50%UnverifiedBefore adopting AiSOC in production environments, it is necessary to evaluate its coverage of alert sources and the accuracy of agent triage.
50%