AiSOC: Open-Source AI SOC With a Signed Audit Ledger

AiSOC, an open-source AI security operations center tool from developer beenuar, hit GitHub trending on November 2 with 446 stars in a single day and more than 6,000 total. AiSOC runs the llama3.2:3b-instruct-q4_K_M model locally via Ollama with no external API calls, records every agent prompt, tool call and citation in an Investigation Ledger that exports as a signed OCSF 1.9.0 bundle, and version 11.2.0 ships 2,603 active detection rules, up from 833 in the previous version. The tool matters because it gives compliance-heavy teams a tamper-evident, auditor-ready record of automated triage decisions that the project says commercial platforms such as Cortex XSIAM and Microsoft Sentinel do not provide, at the cost of CPU-only throughput that caps it at hundreds to low thousands of alerts per day.

AiSOC landed on GitHub trending on November 2, picking up 446 stars in a single day and crossing 6,000 total. It does something commercial AI security platforms charge enterprise rates for — automated alert triage, MITRE ATT&CK investigation, and a full audit trail of every agent decision — and it runs entirely on your hardware, without sending a single byte to an external API. That second part is the point. What It Actually Does AiSOC is a full Security Operations Center stack: it ingests telemetry, runs detection rules, groups fired alerts into incidents, assigns each incident to an LLM agent for investigation, and proposes a response. The human approves before anything executes. What sets it apart from commercial tools is where the transparency lives. Commercial AI SOC platforms give you a verdict. AiSOC gives you the entire reasoning chain — every prompt, every tool call, every citation, and the token cost — recorded in what it calls the Investigation Ledger. Every investigation exports as a signed OCSF 1.9.0 bundle https://schema.ocsf.io/ : tamper-evident, byte-identical, auditor-ready. If an agent cited something, the ledger entry is there. If something was asserted without a citation, the agent labels it “uncited” rather than burying it. That level of transparency is not available in Cortex XSIAM or Microsoft Sentinel. It barely exists as a concept in the commercial space. This is why compliance-heavy teams will take notice. The ledger maps directly to SOC2 Type II, ISO 27001, NIST CSF, and DORA requirements for documented decision chains in automated processes. Zero External APIs AiSOC runs llama3.2:3b-instruct-q4 K M via Ollama https://ollama.com/ — roughly 2 GB, CPU-only, pinned to a specific version for reproducibility. Your security telemetry stays on your infrastructure. For a tool that processes alerts about your systems, this is not a minor design choice; it is the architecture decision that makes the tool viable for any organization with real data handling obligations. The tradeoff is throughput. CPU-only inference on a 3B-parameter model is not going to triage 50,000 alerts per hour. If you are running a high-volume enterprise SOC, that is a ceiling you will hit. For teams dealing with hundreds to low thousands of alerts per day, it is fine. Getting It Running Requirements: Docker Compose v2, 8 GB RAM, 20 GB free disk. Run make doctor to verify prereqs, then: git clone https://github.com/beenuar/AiSOC && cd AiSOC make up That generates fourteen secrets credential vault, session signing key, service-to-service creds, datastore passwords , creates an administrator account, downloads the LLM model, and starts the full stack including Kafka. Credentials print to the terminal. UI is at http://localhost:3000 , API docs at http://localhost:8000/api/docs . First run takes a few minutes for the model download; subsequent starts are fast. The MCP Server AiSOC ships native MCP server support for Claude, Cursor, and Continue. This means you can query your running SOC from inside your IDE — pull current incident context while writing incident-response automation, ask Claude what the SOC is seeing about a specific IP, or build tooling that checks AiSOC before taking action. The security-to-development feedback loop exists as a protocol-level integration now, not just a browser tab you keep open. Detection at Scale v11.2.0 ships with 2,603 active detection rules, sourced from the Sigma community rule library https://github.com/SigmaHQ/sigma of 7,000-plus rules. The previous version ran 833. The delta — 1,770 verified-to-fire additions — includes 1,687 Windows-specific rules that earlier detection systems could not execute. Rules that did not make the cut are logged with rejection reasons, which matters when you need to explain why something was not detected. Alert fusion runs over Kafka: ingest normalizes telemetry, fusion fires rules, correlation groups related alerts into incidents, the agent investigates and writes the ledger, and a human gates any response. Purple team drills let you validate coverage against a known technique list. MITRE ATT&CK maps to the investigation framework throughout. What It Is Not AiSOC is not a Splunk replacement for high-throughput log analytics. CPU inference at 3B parameters does not scale to enterprise-volume alert storms. There is no native Jira or ServiceNow integration in the current release. And the 8 GB RAM minimum means it will not run on an underpowered homelab machine. What it is: the first open-source tool that puts LLM-agent triage, a cryptographically signed audit ledger, and an MCP server in a single make up command. The Investigation Ledger alone is worth the installation. If your team is building on top of AI security tooling and needs auditability — for clients, for compliance, for your own incident retrospectives — there is nothing else like it in the open-source space. The repo is at github.com/beenuar/AiSOC https://github.com/beenuar/AiSOC .