Free AI security operations center for IT security can run on your own server

The open source project AiSOC aims to give companies an AI-driven security operations center that they can run themselves. Such a center is called a SOC (Security Operations Center) and is where teams monitor alerts about possible hacker attacks. The project uses an MIT license, so the code is free to use.

How it works

AI agents read alerts, look up data through typed tools (queries and graph lookups) and write down every action in what is called an Investigation Ledger. According to the project, all prompts and tool calls are logged and can be replayed, so users can trace how a conclusion was reached.

The workflow runs from data ingestion and normalization through detection and correlation to investigation and response. According to the documentation, the agents are orchestrated with LangGraph, and specialized agents are mentioned for phishing, identity threats and insider risks.

Response actions require human approval, and destructive commands require explicit approval. The AI cannot step in on its own without a human.

Numbers from the project itself

The repository lists 87 data connectors, including for Splunk, Sentinel, Elastic, CrowdStrike, Okta, AWS and Kubernetes. It cites 2,530 executable detection rules out of 7,015. The documentation instead mentions 2,535 executable rules plus 4,480 imported for coverage mapping, so the figures differ.

The project also states that 1,734 of 2,005 Splunk rules can be translated, and that 44 of 50 triage decisions were usable before a JSON constraint was introduced. These are the project's own figures. The Product Hunt listing mentions a public evaluation framework with 200 test incidents.

Installation and limitations

There are three profiles: Core (about 8 GB RAM), Full (about 12 GB RAM, with event storage, entity graph and search) and Demo with synthetic data. It requires Docker Compose v2, 20 GB of free disk space and Python 3.9+.

The system can run without API keys using a local Ollama model and, according to the documentation, supports local language models in air-gapped environments. However, the repository states that no hosted provider has been tested. There is also an MCP server that can be connected to Claude, Cursor and Continue, among others.

The documentation admits several gaps: TAXII handling is only a demo, the MITRE coverage report shows only tagged techniques and not how well detection works, and there is no automatic rule generation for techniques without coverage.

Who is behind it

According to the project, development is funded and supported by the security company Cyble, which releases it openly without special treatment or telemetry. The Product Hunt listing names Beenu Arora, cofounder and CEO of Cyble, as the maker. All information here comes from the project's own pages, and no independent testing of the tool has been found.