AiSOC: How an Open-Source AI Security Operations Center Audits Every Agent Decision

Description and use

<p>AiSOC (6,106 GitHub stars, MIT licensed) is a self-hosted Security Operations Center that hands security alerts to LLM agents, records every reasoning step in a replayable ledger, and gates all responses behind human approval. It addresses the core trust problem in security automation: how do you verify an agent's decision when it's triaging a potential breach?</p> <p>The project runs 2,534 executable rules from a 7,015-rule library, correlates raw telemetry into incidents, and investigates each one using MITRE ATT&CK mappings. Every prompt, tool call, and state transition goes into an

Problem

<p>AiSOC (6,106 GitHub stars, MIT licensed) is a self-hosted Security Operations Center that hands security alerts to LLM agents, records every reasoning step in a replayable ledger, and gates all responses behind human approval. It addresses the core trust problem in security automation: how do you verify an agent's decision when it's triaging a potential breach?</p> <p>The project runs 2,534 executable rules from a 7,015-rule library, correlates raw telemetry into incidents, and investigates each one using MITRE ATT&CK mappings. Every prompt, tool call, and state transition goes into an

Outcome

<p>AiSOC (6,106 GitHub stars, MIT licensed) is a self-hosted Security Operations Center that hands security alerts to LLM agents, records every reasoning step in a replayable ledger, and gates all responses behind human approval. It addresses the core trust problem in security automation: how do you verify an agent's decision when it's triaging a potential breach?</p> <p>The project runs 2,534 executable rules from a 7,015-rule library, correlates raw telemetry into incidents, and investigates each one using MITRE ATT&CK mappings. Every prompt, tool call, and state transition goes into an

Evidence

AiSOC: How an Open-Source AI Security Operations Center Audits Every Agent Decision

Source