AiSOC: a self-hosted AI SOC whose defaults are safe on a laptop and unreachable on a server

From raw telemetry to an AI verdict a human signs off

Events arrive from your security tools, get normalized, and run against the 2966 executable rules in a 7407-rule library. Matches are grouped into incidents, an AI agent investigates each incident with every prompt and tool call recorded, and the system proposes an action. A human approves before anything reaches a vendor. New threat intelligence re-sweeps history already collected, so an indicator published today can match last week's events. The gap between 7407 rules and 2966 executable ones matters when you size coverage: the larger number is the library, the smaller one is what runs. The project keeps its own audit of what works in docs/audit/REPOSITORY_REALITY.md.

make up generates fifteen secrets and shows the admin password once

The quick start is two lines:

git clone https://github.com/beenuar/AiSOC && cd AiSOC
make up

make up creates .env and fills fifteen generated secrets, including the credential vault key, the session signing key, five service-to-service credentials and four datastore passwords. It then creates an administrator and prints a password generated on your machine, shown once and stored nowhere. If you lose it, make bootstrap ARGS=--reset-password mints another. The .env.example ships those values empty on purpose: a non-empty AISOC_CREDENTIAL_KEY that was not a valid Fernet key once made every connector save return HTTP 500. If a port such as 5432 or 11434 is taken, the install picks a free one and moves the console address with it. To confirm the pipeline, make smoke posts one event and follows it through Kafka, detection, correlation and Postgres:

$ make smoke
[PASS] raw telemetry accepted by ingest
[PASS] event traversed the spine and became an alert
PASS: 10/10 stages

Loopback bindings and shipped development passwords

Every host port in docker-compose.yml binds to 127.0.0.1, because Postgres, Kafka, OpenSearch, Neo4j and Redis carry development passwords that are identical in every clone. That is right for a laptop and wrong for a server: a single-host install is unreachable from any other machine, including your browser. The fix is one variable in .env:

AISOC_CONSOLE_BIND_ADDR=0.0.0.0

That publishes only the console, which proxies to every other service over the internal network. AISOC_BIND_ADDR moves all bindings, datastores included, and on a routable network it exposes those shared passwords. The consequence of picking the wrong variable is an open database with publicly known credentials, so use the console variable and put a TLS-terminating reverse proxy in front.

An 8 GB floor and a 2 GB model that only make clean removes

The stack needs Docker Compose v2 with 8 GB of memory and 20 GB of free disk in the Docker VM, plus python3 3.9 or newer and bash; make doctor checks all of it. The core profile runs Postgres, Redis, Kafka, ingest, fusion, the API, web console, agents, an LLM gateway with a local model, and the threat-intel feed. The full profile adds ClickHouse, Neo4j, OpenSearch, enrichment and scheduled connectors and needs about 12 GB. The first run downloads a model of about 2 GB into a volume that only make clean clears, so ordinary restarts keep it and reclaiming that disk is a deliberate step. Without Docker at all, pip install aisoc-sandbox && aisoc-sandbox demo walks one alert through the agent funnel offline.

Getting real events in: push with a token or pull through connectors

To push, get a credential from make ingest-token; the tenant comes from the token, not a header:

curl -X POST http://localhost:8081/v1/ingest/batch \
  -H 'Content-Type: application/json' -H "Authorization: Bearer $AISOC_INGEST_TOKEN" \
  -d '{"connector_id":"edr-1","connector_type":"crowdstrike","events":[{"severity":"high",
       "title":"Encoded PowerShell from Office","host":"WIN-FIN-01"}]}'

To pull, configure one of 91 connectors under Settings, Connectors. Splunk, Sentinel, Elastic, CrowdStrike, Okta, AWS and Kubernetes audit have vendor-specific normalization; any other connector falls back to a generic mapping that resolves only host, user and source IP, so detections that depend on richer fields will not see them. Cloud logs come through collectors such as a CloudTrail trail on S3 notified over SQS and a GCP Pub/Sub subscription. Interactive API docs are off in this stack; the spec is docs/openapi.yaml.

Sample and demo data are labelled so they cannot pass for real incidents

A tenant with nothing connected opens on a setup wizard. Its Load sample data button sends five scenarios, from low to critical, through the same ingest path a connector uses. They are attributed to AiSOC in the source column, refuse to load into a tenant that already has real alerts, and do not mark setup complete. make demo loads a larger synthetic corpus where every row has is_synthetic = true and is labelled in the console; it shows the pipeline shape and is not a benchmark.

Major versions arrive days apart

v20.3.0 shipped on 30 October 2026, v20.4.0 on 31 October and v21.0.0 on 1 November, and the last push was on 3 November 2026. A major version bump one day after a minor release means teams running AiSOC in production should pin a version, read CHANGELOG.md and RELEASES.md before upgrading, and not track main. The demo recording also predates the v20.1.0 screenshots shown with it, so the console you install will not match either exactly.

Editorial conclusion

AiSOC suits security teams that want to run their own detection, correlation and AI-assisted triage stack, keep a human approval step before any response reaches a vendor, and can give it a Docker VM with at least 8 GB of memory. It is not a fit for anyone who wants a hosted service or expects the full 7407-rule library to execute. Before deploying beyond a laptop, set AISOC_CONSOLE_BIND_ADDR rather than AISOC_BIND_ADDR, put a TLS reverse proxy in front, and pin a release, since major versions have changed within days of each other.

Frequently asked questions

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes