AiSOC

Product Introduction

1. Definition: AiSOC is an open-source, self-hostable AI Security Operations Center (SOC) platform. Technically, it is a multi-agent orchestration system built on a LangGraph framework, integrated with real-time data fusion, a detection engineering catalog, and compliance tooling to automate and audit security investigations.
2. Core Value Proposition: AiSOC exists to solve the critical "black-box" problem in AI-driven security. It provides the power of autonomous AI agents for threat investigation and response while ensuring every decision is transparent, auditable, and replayable. This enables security teams in regulated industries to leverage AI for Security Operations Center efficiency while meeting strict evidence requirements for frameworks like SOC 2, ISO 27001, NIST, and DORA.

Main Features

1. Auditable Agent Ledger: Every operation within the AI investigation loop is recorded. This includes the exact prompts sent to LLMs, the tool calls made by agents (e.g., querying a database, running a YARA rule), and the chain-of-thought reasoning. This ledger is persisted and allows for step-by-step replay of any investigation, providing a complete audit trail for compliance and forensic review.
2. Public Evaluation Harness: AiSOC includes a publicly accessible, CI-gated regression test suite of over 200 security incidents. This harness validates the entire substrate—data extractors, fusion logic, prompt templates, and agent judges—ensuring updates do not break core functionality. It provides reproducible, transparent benchmarks for detection and response accuracy, a feature absent from closed-source AI SOC vendors.
3. Real-Time Fusion & Detection Spine: The platform uses Apache Kafka as a high-throughput messaging backbone for sub-second alert ingestion. It employs Bloom filters for deduplication of over 10 million IOCs and integrates machine learning models like LightGBM and Isolation Forest for scoring anomalies. This creates a scalable, real-time data fusion layer that feeds the AI agents with enriched, deduplicated context.
4. Compliance Evidence Dashboards: Built-in dashboards automatically generate and track evidence required for major compliance frameworks. This includes continuous monitoring of key security metrics like Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and Mean Time to Contain (MTTC) against SLAs for SOC 2, ISO 27001, NIST CSF, PCI-DSS, HIPAA, and DORA.
5. Purple Team & Attack Graph Module: AiSOC integrates offensive security tools for proactive defense. It includes an Atomic Red Team YAML parser for automated adversary emulation, a Caldera executor, and generates MITRE ATT&CK coverage heatmaps. The Neo4j-based attack graph visualizes entity relationships and reconstructs attack paths, enabling blast-radius analysis to gate automated response actions.

Problems Solved

1. Pain Point: The lack of transparency and auditability in commercial "black-box" AI security tools creates compliance and operational risk. Security teams cannot verify AI decisions, making it difficult to pass audits under SOC 2 or ISO 27001 controls that require reviewable processes.
2. Target Audience: Security teams and compliance officers within regulated environments (finance, healthcare, government, enterprise). Specifically, Security Operations Center (SOC) analysts, threat hunters, and DevSecOps engineers in organizations that require self-hosting, data sovereignty, and detailed evidence for governance frameworks.
3. Use Cases: Automated Triage & Enrichment: AI agents autonomously triage incoming alerts, enrich them with context from internal data sources, and provide a summarized rationale. Compliance Auditing: Providing an immutable, replayable record of every AI-driven investigation step to an external auditor. Purple Teaming: Running automated adversary emulation campaigns, mapping results to the MITRE ATT&CK framework, and identifying detection gaps in the security posture.

Unique Advantages

1. Strengths & Limitations (Pros & Cons):

   • Pros:
     • Unprecedented Auditability: The investigation ledger is a core architectural differentiator, directly addressing compliance needs.
     • Full Ownership & Control: MIT license with no CLA, telemetry, or vendor lock-in. Complete freedom to self-host, modify, and inspect all code, prompts, and templates.
     • Integrated Platform: Combines AI agents, SIEM-like fusion, detection engineering, compliance dashboards, and purple teaming in a single cohesive stack.
     • Transparent Benchmarking: The public eval harness provides verifiable performance claims, unlike vendor-marketed metrics.
   • Cons:
     • Operational Overhead: Self-hosting a platform with this many components (Kafka, Neo4j, Postgres, OpenSearch/ClickHouse) requires significant DevOps and security engineering resources.
     • Maturity & Integration: As an open-source project, enterprise-grade support, professional services, and pre-built integrations with specific commercial security products may be limited compared to established vendors.
     • AI Agent Reliability: The effectiveness is inherently tied to the underlying LLM's capabilities and the quality of the provided context, which requires tuning and can produce unpredictable outputs.

2. Key Alternatives & Differentiation:

   • Commercial SIEMs (e.g., Splunk, Sentinel): These are primarily data aggregation and correlation engines. While they may offer paid AI assistant add-ons, the AI logic is closed-source and not auditable line-by-line. AiSOC differentiates by baking an auditable, multi-agent AI layer directly into its core and offering it as open-source.
   • Closed-Source AI SOC Platforms (e.g., vendors like Tines, Torq with AI features): These run on vendor infrastructure and treat the AI agent loop as a proprietary black box. AiSOC's fundamental difference is its open-source nature and the investigation ledger, making it uniquely suited for environments where auditability is non-negotiable.
   • Open-Source SIEMs (e.g., Wazuh): Projects like Wazuh are excellent at host-based intrusion detection (HIDS) and log analysis but lack a native, orchestrated AI investigation agent layer. AiSOC complements these by adding the AI-driven investigation and compliance automation layer on top of a similar data fusion foundation.

Frequently Asked Questions (FAQ)

1. How does AiSOC ensure compliance with SOC 2 and ISO 27001? AiSOC generates compliance evidence through built-in dashboards that track control metrics (MTTD, MTTR, etc.) and, most critically, provides the auditable investigation ledger. This ledger records every AI agent step, allowing auditors to verify the integrity and reasoning of automated security processes, directly satisfying requirements for reviewable procedures.
2. Can AiSOC replace my existing SIEM or EDR? AiSOC is not a direct 1:1 replacement for a traditional SIEM or Endpoint Detection and Response (EDR) platform. It is designed as an AI-powered investigation and automation layer that sits on top of your existing data sources (SIEM logs, EDR alerts, cloud trails). It ingests alerts via Kafka and enriches/acts upon them, making it a complementary force multiplier for your SOC.
3. What is the total cost of ownership for a self-hosted AiSOC deployment? The primary costs are not licensing fees (as the software is free under MIT license) but infrastructure and personnel. Costs include cloud/on-prem compute/storage for running the stack (Postgres, Kafka, Neo4j, etc.), the operational overhead for your DevOps/SecOps team to deploy, maintain, and tune the system, and potentially costs for commercial LLM APIs (e.g., OpenAI, Anthropic) if not using a self-hosted model.
4. How does the public eval harness work and why is it important? The harness is a suite of over 200 simulated security incident cases that run in a Continuous Integration (CI) pipeline. Every code change triggers a run of these tests to ensure core detection, enrichment, and response logic does not regress. Its importance lies in providing transparent, reproducible proof of the system's capabilities, moving beyond marketing claims to verifiable, code-based benchmarks.
5. Is AiSOC suitable for a small security team? The suitability depends on the team's technical capacity. While the AI automation can significantly reduce manual triage work, the initial deployment, integration, and ongoing maintenance of the platform require strong DevOps and security engineering skills. For a small but highly technical team, it can be powerful. For teams without dedicated infrastructure expertise, the operational burden may be challenging.