beenuar/AiSOC: README-based editorial guide

beenuar/AiSOC describes itself in the README as "Open-source AI-powered Security Operations Center , alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.". This article keeps to facts that can be checked in the repository. Stars, forks, and promotional badges are signals of attention, not proof of quality. Under "AiSOC", the README says: An open-source, self-hostable AI SOC. The agent's prompts, tool calls, and rationale are logged step-by-step and replayable. MIT-licensed.. That establishes the project's stated boundary, not a production test.

The README's "What's in the box" section gives a useful starting point for deciding whether the project fits: End-to-end SIEM spine , a cold docker compose up ingests connector data → lands it in the ClickHouse event lake → the executable detection corpus (947 rules) fires on the live stream → a fused alert is created, all asserted by an extended. If that problem is not yours, popularity is a poor reason to adopt it. Project names, commands, and component names are kept as written so a reader can return to the primary source without guessing at terminology. Another checkable README item is: 83 click-and-connect data connectors (EDR/XDR, SIEM, NDR, cloud, CNAPP, identity, SaaS, VCS, K8s audit, network) with schema-driven config, live Test connection, and vault-encrypted secrets , recently adding Qualys, GreyNoise, JumpCloud,. It can shape a first test, but it does not replace testing in the intended environment.

The operating model is spread across sections such as "Try AiSOC in 60 seconds". The source evidence includes: The wedge CLI scores a batch of alerts to verdicts (escalate / review / suppress) with a deterministic engine ported from the production triage scorer , zero LLM key required.. This article does not turn missing architecture, performance, or security details into claims. A real deployment still needs a look at the repository layout, configuration files, and release history.