beenuar/AiSOC
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
Build with Backblaze B2
SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.
Loading star history...
Where it stands
Rank, growth pace and release cadence relative to everything GStars tracks.
5 releases in the last 90 days, the latest 2 days ago, with 21 contributors on GitHub.
Use Cases & Benefits
- Provides a self-hostable AI-driven Security Operations Center for alert fusion, autonomous triage, MITRE ATT&CK investigation, and replayable decision logging.
- Enables full control over data and AI decisions with no external API keys, open-source transparency, and a public evaluation harness for reproducible security alert triage.
- Use for automating alert triage and incident investigation in enterprise SOCs to reduce analyst workload and false positives.
- Use for developing and testing custom detection rules, connectors, and playbooks with CI-gated validation and a rich plugin SDK.
- Use for integrating AI-powered security investigations into IDEs or chat tools via the MCP server for seamless analyst workflows.
Should you depend on it?
License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.
License
MIT
Permissive: commercial use, modification and redistribution are allowed with attribution.
Community files
- README: present
- Contributing guide: present
- Code of conduct: present
Watch-outs
No watch-outs from GStars' checks.
General guidance from repository metadata, not legal advice. How we score
From the README
An open-source, self-hostable AI SOC. The agent's prompts, tool calls, and rationale are logged step-by-step and replayable. MIT-licensed.
The community-maintained demo at tryaisoc.com runs on Fly.io and can go offline; see docs/operations/live-demo-runbook.md and use Codespaces as the always-on fallback.
90-second walkthrough — agent investigates the seeded LockBit 3.0 case end-to-end. The rendered .mp4 + hero.gif land with the v8.0 launch; the brief is in docs/demo/SCREENCAST_SHOTLIST.md.
Daily snapshots
Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots
+4,764 stars over 84 days across 11 snapshot days; best day +474 on Nov 3.
Forks
719+474
Open issues
14+8
Compared with peers in Security
Fastest-growing repositories GStars tracks in this cohort for the week of Nov 1, by 7-day star growth
| Repository | Stars | +7d | Health | Last release |
|---|---|---|---|---|
| cloudflare/security-audit-skill | 61.7K | +8.8K | 17 | — |
| KeygraphHQ/shannon | 51.2K | +1.1K | 32 | 8 days ago |
| vxcontrol/pentagi | 33.5K | +712 | 38 | 31 days ago |
| Asymptote-Labs/agent-beacon | 3.3K | +360 | 40 | today |
| caddyserver/caddy | 78.8K | +267 | 60 | 1 day ago |
| beenuar/AiSOC | 7.0K | — | 65 | 2 days ago |
| Category median | 51.2K | +712 | 38 | — |
Discover Repositories
Search across tracked repositories by name or description