beenuar/AiSOC
Self-hosted AI SOC that triages security alerts with agents and logs every reasoning step.
Ingests security telemetry, runs it through a library of 7,023 detection rules (2,538 currently executable), groups what fires into incidents, and hands each one to an AI agent that investigates against MITRE ATT&CK with every prompt and tool call recorded for replay. A human still approves any action before it reaches a vendor system. It's MIT-licensed, self-hostable with no API keys required, and ships an MCP server so Claude, Cursor or Continue can drive it directly; with nothing connected, it shows an empty screen rather than a staged demo.
What holds up
- +MIT licensed and self-hostable — no API keys and no vendor lock-in to run it
- +Every agent prompt and tool call is recorded, so an investigation can be replayed step by step
- +Shows an honest empty state with nothing connected, instead of faking a demo
- +Human approval gate before any action reaches an outside vendor
Mind the limits
- −Only 2,538 of the library's 7,023 rules are currently executable — the rest aren't live yet
- −Self-hosting an AI SOC is real infra to run and maintain, not a hosted SaaS click-through
Picked here? Add the badge
Put it on your site. It links back to this page. Free for every listed product.
<a href="https://stillworks.dev/products/p/beenuar-aisoc/"><img src="https://stillworks.dev/badge/beenuar-aisoc.svg" alt="Picked by StillWorks" width="230" height="54"></a>