AiSOC is a self-hosted AI security operations center (SOC). It ingests security telemetry, runs detection rules over it, correlates what fires into incidents, has AI agents investigate each incident with a recorded trail, and proposes responses that a human approves before anything reaches a vendor.
Ingest normalizes events from push or pull connectors into a common shape and carries them over Kafka. The fusion stage runs 2,511 executable detection rules (of a 6,991-rule library) plus 72 sliding-window rules, applies each tenant's own tuning, and decides what becomes an alert. A rule counts as executable only after a vendor-shaped event replayed through the real connector and engine makes it fire. Correlation groups alerts into incidents, an agent investigates, and a playbook may start from the result. New threat intelligence re-sweeps already collected history for sightings.
Agents read the alert, its correlated siblings, entity context, and prior verdicts, and call typed tools (lake queries, graph traversals, enrichment lookups) instead of writing SQL. Every prompt, tool call, citation, verdict, and token cost goes to an Investigation Ledger that exports as a signed evidence bundle. A verdict that cites an indicator missing from the evidence drops to human review, and prompts carrying raw logs or secret-shaped values are refused before they are sent.
The core profile bundles an LLM gateway with a small local Llama model served by Ollama for CPU-only triage, so it produces verdicts without any credentials. You can switch to a GPU, a host model, or your own provider from the console.
| Profile | Services | Memory | Contents |
|---|---|---|---|
| core | 16 | about 8 GB | Ingest, detection, correlation, alerting, triage, console, LLM gateway, local model, CISA KEV feed |
| full | 22 | about 12 GB | Core plus event lake, entity graph, full-text search, and enrichment |
| demo | 16 | about 8 GB | Core plus labeled synthetic data |
Features
- Data connectors: 87 click-and-connect connectors, including Splunk, Sentinel, Elastic, CrowdStrike, Okta, AWS, and Kubernetes audit, plus a generic mapping for anything else
- Cloud log collectors: reads CloudTrail through S3 and SQS, GCP Pub/Sub, Azure Event Hubs, and syslog or CEF with resumable cursors and backpressure
- Detection migration: translates Splunk SPL, Sentinel KQL, and Elastic EQL rules and refuses rules it cannot carry faithfully
- Investigation Ledger: records prompts, tool calls, citations, verdicts, and token cost, exportable as a signed OCSF evidence bundle
- Cited copilot: answers cite each checkable claim to a ledger entry and label the rest as uncited
- Governed playbooks: alert-triggered playbooks preview by default and need deployment, tenant, and playbook opt-ins, with durable approval pauses that survive restarts
- Hunting: a 68-hunt YAML library and hypothesis-driven hunts over a ClickHouse event lake, where the model fills a closed schema instead of writing queries
- Entity graph and UEBA: a Neo4j entity graph and user and entity behavior analytics in the full profile
- Threat intelligence: polls the public CISA Known Exploited Vulnerabilities catalog and re-sweeps collected history when new intelligence arrives
- Multi-tenant controls: per-tenant detection tuning, SCIM 2.0, white-labeling, and usage metering
- Sample and synthetic data: sample scenarios run through the real ingest path, and every synthetic row is labeled in the console
