Practical overview
When it fits
Use Aisoc when you want a self-hosted workflow that carries security telemetry through detection, incident investigation and analyst-reviewed response proposals.
Who it is for
- Security operations teams that need to triage and investigate alerts from their security telemetry.
- Teams seeking a self-hosted, open-source workflow with a reviewable record of AI-agent reasoning.
- Developers who want to expose security investigation tools to Claude, Cursor or Continue through MCP.
Documented uses
- Ingest and normalize telemetry from security tools.
- Detect threats and group detections into incidents.
- Investigate incidents with AI agents and review their recorded prompts and tool calls.
- Resweep collected history when new threat intelligence becomes available.
- Prepare response proposals for human approval.
Requirements & limits
Aisoc is open source under the MIT license. Its documented self-hosted setup requires Docker Compose v2, Python 3.9 or later, Bash, and a Docker VM with 8 GB memory and 20 GB free disk. Startup creates an administrator account and prints its generated password.
- Self-hosting requires the stated Docker VM resources, and the first run downloads an approximately 2 GB model.
- The service records agent prompts and tool calls, while responses remain subject to human approval.
- Sample events use the ingest path but are labeled as Aisoc data and do not complete setup.
- The MCP server names Claude, Cursor and Continue as clients, but the complete tool set and client setup steps are not specified here.
Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.
Verify the AiSOC telemetry pipeline with a smoke test
Check that one test event passes through ingestion, detection, correlation, and alert retrieval.
Before you start
- A started AiSOC stack
Steps
Run the command below from the AiSOC repository.
make smokeReview the PASS or FAIL results for the ingest, pipeline, and alert retrieval stages.
Expected outcome
The test posts an event to the ingest API, follows its processing through Kafka, detection, correlation, and Postgres, and reads the resulting alert through the public API.
Guide limitations
- This smoke test verifies a single event path; it does not establish that a real security connector is configured.
Sources & review
Source record details
- Source availability
- Active
- Sources checked
- 9 October 2026
- Original website title
- beenuar/AiSOC · Official homepage title · retained in its source language