beenuar/AiSOC

Traditional SOCs are overwhelmed by alert noise and require expensive human analysts for repetitive triage. AiSOC solves this by using a deterministic scoring engine and AI agents to automatically suppress false positives (e.g., 85.5% noise reduction in demo) and escalate true positives, while providing full transparency through step-by-step logging. It also democratizes AI security operations by being open-source and self-hostable, unlike proprietary commercial SOC platforms.

Developers can build a complete AI-driven SOC pipeline that ingests alerts, triages them, investigates incidents using MITRE ATT&CK, and even runs purple-team drills to test detection. Real-world use cases include automated phishing triage, lateral movement detection, AWS credential exfiltration, Kubernetes privilege escalation, and GitHub token theft. The ceiling is high: with the full stack (Postgres, Redis, Kafka, API, agents, web UI), you can deploy a production-grade SOC that handles thousands of alerts, integrates with existing SIEMs, and provides replayable audit trails for compliance.