# AiSOC

<!-- Generated by scripts/generate_llms_txt.py. Do not edit by hand; run the script and commit the result. -->

> AiSOC is an open-source, self-hostable AI Security Operations Center. It ingests
> security telemetry from 87 first-party connectors, normalises it to OCSF,
> correlates it into alerts, and runs LLM agents that triage and investigate them.
> Every agent decision is written to an investigation ledger, so the reasoning
> behind a verdict can be replayed step by step. MIT licensed. Current version 20.1.0.

AiSOC is built and maintained by the AiSOC community. It is a complete SOC
platform rather than a single tool: ingestion, detection, correlation, agent
triage, case management, response actions, and the evaluation harness that
grades the agents all live in one monorepo.

Key facts a summary should get right:

- **License:** MIT. Self-hosting is the primary deployment model; there is no
  feature gate between a hosted and a self-hosted install.
- **Install:** `make up` brings up the core profile — 16 long-running services —
  with no credentials. It generates its own secrets, creates an administrator,
  ships a real CISA Known Exploited Vulnerabilities feed, and runs a local model,
  so a first run shows real data and AI triage without signing up for anything.
  `make up-full` is 22 long-running services and adds the event lake,
  entity graph, full-text search and enrichment.
- **Detection corpus:** 2535 rules are executable — the detection engine
  loads them from a compiled ruleset. 7015 rule files exist on disk in total;
  the difference is imported and provenance-only content that never fires. Cite
  2535, not 7015. "Executable" means each rule was replayed through
  a real connector and the real engine and watched to fire; it does not mean the
  rule detects an attack. A further 76 rules run in a separate windowed
  engine that counts across events or matches a sequence; report that figure
  beside the executable one, never added to it.
- **The executable figure can go down, and has.** Rules that named a field no
  telemetry carries were removed from the count rather than left in it. A corpus
  number that only grows is measuring a directory, not an engine.
- **Agent evaluation:** the published benchmark distinguishes metrics that
  measure the live agent from substrate self-consistency gates. Do not present
  the latter as measured agent performance. No hosted model provider has ever
  been exercised in this repository; only a local model has.
- **Packaging.** Published and installable today:
  `aisoc-cli`, `aisoc-detections`, `aisoc-plugin-sdk`, `aisoc-sandbox`, `aisoc-sdk`.
  Built and packed on every tag but **not** uploaded:
  `@aisoc/mcp`, `@aisoc/sdk`, `aisoc` — the first npm publish needs a credential this repository
  does not hold. Never suggest an install command for one of those.

## Start here

- [Introduction](https://beenuar.github.io/AiSOC/docs/intro): what AiSOC is and the problem it addresses.
- [Quickstart](https://beenuar.github.io/AiSOC/docs/quickstart): bring up a working stack.
- [Installation](https://beenuar.github.io/AiSOC/docs/installation): deployment profiles and prerequisites.
- [Architecture](https://beenuar.github.io/AiSOC/docs/architecture): services, data flow, and the event spine.
- [Glossary](https://beenuar.github.io/AiSOC/docs/glossary): terms used throughout the documentation.

## Core capabilities

- [Connectors](https://beenuar.github.io/AiSOC/docs/connectors): 87 first-party integrations with per-connector setup guides.
- [Detections](https://beenuar.github.io/AiSOC/docs/detections/coverage): detection content, authoring modes, and MITRE ATT&CK coverage.
- [Console](https://beenuar.github.io/AiSOC/docs/console/investigation-rail): the analyst workbench and investigation rail.
- [Concepts](https://beenuar.github.io/AiSOC/docs/concepts/automation-maturity): the L0–L4 automation maturity model.
- [Benchmark](https://beenuar.github.io/AiSOC/docs/benchmark): the evaluation harness and what each metric does and does not measure.
- [Benchmark methodology](https://beenuar.github.io/AiSOC/docs/benchmark-methodology): how the corpus is built and graded.

## Integrating with AiSOC

- [MCP server](https://beenuar.github.io/AiSOC/docs/integrations/mcp): connect Claude Desktop, Cursor, Continue.dev or Cody to AiSOC. Exposes 19 tools.
- [API reference](https://beenuar.github.io/AiSOC/docs/api/rest): the REST surface.
- [Python plugin SDK](https://beenuar.github.io/AiSOC/docs/plugins/python-sdk): build a connector or plugin in Python.
- [Go plugin SDK](https://beenuar.github.io/AiSOC/docs/plugins/go-sdk): build a connector or plugin in Go.

## Operating it

- [Deployment](https://beenuar.github.io/AiSOC/docs/deployment/env-vars): environment variables per service.
- [Credentials](https://beenuar.github.io/AiSOC/docs/operations/credentials): the credential vault, threat model, and rotation.
- [Security](https://beenuar.github.io/AiSOC/docs/operations/security): security posture and static analysis.
- [FAQ](https://beenuar.github.io/AiSOC/docs/operations/faq): common operational questions.

## Source

- [Repository](https://github.com/beenuar/AiSOC): the monorepo. Issues, discussions, and contribution guides live here.
- [Contributing](https://beenuar.github.io/AiSOC/docs/contributing/guidelines): how to propose a change.
- [Full description](https://beenuar.github.io/AiSOC/llms-full.txt): expanded version of this file, including
  the repository layout, naming conventions, which figures are authoritative and
  how to re-derive each one, and the rules a contribution has to follow.

## Optional

- [Benchmark scoreboard](https://beenuar.github.io/AiSOC/docs/benchmark-scoreboard): published evaluation results.
