AiSOC

AiSOC is a self-hostable security operations centre in which agents ingest security events, correlate them into alerts, investigate, and propose or execute a response. Each step of a run — the model prompt, the response, the evidence cited, and the tool calls that followed — is written to an Investigation Ledger that can be replayed afterwards.

Events arrive through more than 80 schema-driven connectors spanning endpoint and network detection, SIEM, cloud, identity, SaaS, source control, and Kubernetes audit logs, are normalised to OCSF, and travel on a Kafka spine. An executable corpus of roughly 950 rules fires on the live stream alongside stateful windowed detections for brute force, password spray, and port scanning, while machine-learning fusion and user-behaviour baselines turn signals into scored alerts enriched with threat intelligence and known-exploited-vulnerability data. Storage spans PostgreSQL, ClickHouse as the event lake, OpenSearch, Qdrant, Neo4j, and Redis.

The investigation agent is a LangGraph orchestrator of roughly 600 lines. Auto-triage runs in copilot or read-only mode by default, with a prompt-injection guard that demotes tampered evidence to manual review, and a policy combining confidence, blast radius, and reversibility decides what may execute on its own; everything else waits for a person, and what does run has rollback and post-action verification. A hunt workbench takes a hypothesis in plain language and returns ES|QL, SPL, or KQL to save and schedule, and one federated query runs across Splunk, Sentinel, Elastic, and QRadar.

Entry points range from an in-memory sandbox that simulates the agent funnel offline and a keyless triage command that scores a batch of alerts deterministically, through Docker Compose, to Helm and Terraform for production. With a hosted model, evidence is pseudonymised by default, turning internal addresses, hostnames, emails, paths, secrets, and usernames into opaque tokens; a local model gives an air-gapped path, and there are no vendor callbacks or model-improvement telemetry. Five evaluation suites gate every pull request onto the main branches, measuring alert reduction against a fixed 1,000-alert stream, substrate self-consistency over a 200-incident dataset, and the backing telemetry corpus.

Features

• Investigation Ledger: per-step prompts, responses, cited evidence, and tool calls, stored and replayable
• Connectors: more than 80 schema-driven connectors with live connection tests and vault-encrypted secrets
• Detection corpus: roughly 950 executable rules on the live stream plus a provenance-tracked imported library
• Alert fusion: ML fusion and behaviour baselines with threat-intel and KEV enrichment feeding a confidence score
• Autonomous triage: copilot-by-default triage with a prompt-injection guard routing tampered evidence to review
• Governed response: a confidence, blast-radius, and reversibility policy, with rollback and post-action verification
• Hunt workbench: plain-language hypotheses compiled to ES|QL, SPL, or KQL, saved and scheduled
• Federated search: one query across Splunk SPL, Sentinel KQL, Elastic ES|QL, and QRadar AQL
• Eval harness: five CI-gated suites over fixed alert and incident datasets, documented per suite
• Data control: pseudonymised evidence with hosted models, or a local model for an air-gapped deployment
• Plugin SDK: Python, TypeScript, and Go plugins, with a marketplace for plugins, playbooks, and detections
• Deployment paths: in-memory sandbox, keyless triage CLI, Docker Compose, Kubernetes Helm charts, and Terraform