Hey hunters, Beenu here. Eight months heads-down, today we are open-sourcing AiSOC. The premise: stop bolting LLMs onto SIEM dashboards as a chat sidebar, and build the SOC around agents from day one. Three things I think you will care about. 1. Investigation Ledger. Every prompt, LLM response, evidence row, and tool call lands in Postgres. Signed, replayable. If an agent says "this is a TP," you can rewind the exact reasoning. 2. Public eval harness in CI. 5 suites, 200 incidents across 55 templates, a 1,000-alert noisy stream, and a 360-event synthetic telemetry corpus across 14 log sources. Runs on every PR. No SOC vendor publishes their evals. We do. 3. 11-tool MCP server. Plug AiSOC into Claude Desktop, Cursor, Continue, or Cody and your agent gets a SOC. MIT, self-hostable, no phone-home. Demo at https://tryaisoc.com. Repo at https://github.com/beenuar/AiSOC. Issues, PRs, and roasts welcome.

AiSOC

The SOC, rebuilt for AI agents. Open source.

The SOC, rebuilt for AI agents. Open source.