中文版

AiSOC（GitHub：https://github.com/beenuar/AiSOC ，2026-05-02 创建，今晨抓取时已 6,220★）是开源、可自托管的 AI 安全运营中心（SOC）：接进你的安全遥测，检测并关联威胁，用 AI agent 调查，最后把处置建议交给人批准。

按 README 的说法，它先把各安全工具的遥测归一化，用 7023 条规则库中 2538 条可执行规则跑检测，把命中的告警聚成事件，再由 AI agent 逐个调查——每一步的提示词与工具调用都被完整记录、可回放审计；新威胁情报进来还能重扫已收集的历史数据；任何动作到达厂商之前都要经过人工批准。它不需要 API key 也能跑：真实的 CISA KEV（已知在野利用漏洞）目录开机几分钟内就已就位；还附带给 Claude、Cursor、Continue 用的 MCP 服务器。启动方式是 make up 一键起栈（需 Docker Compose v2、8GB 内存、20GB 磁盘，首次运行下载约 2GB 模型），MIT 协议开源。

为什么值得了解

• 安全运营中心长期是贵且封闭的领域；这个项目把“AI agent 做一线分流 + 全程可审计”做成了一个能自托管跑起来的完整系统，是研究安全 agent 落地形态很好的参考实现
• “每一步可回放”这个设计值得所有做 agent 的人借鉴：agent 在敏感场景里犯错不可怕，可怕的是说不清它为什么这么干——AiSOC 把审计做进了架构
• 它契合不绑卡的偏好：自托管、无 API key 强制要求；但体量不小（Docker 栈 + 2GB 模型），更适合有服务器或想深入研究安全 agent 的人，而不是找轻量小工具的场景

English Version

AiSOC (GitHub: https://github.com/beenuar/AiSOC , created 2026-05-02, 6,220 stars at this morning’s fetch) is an open-source, self-hostable AI Security Operations Center: it ingests your security telemetry, detects and correlates threats, investigates them with AI agents, and hands response proposals to a human for approval.

Per the README, it normalizes telemetry from your security tools, runs detection over 2,538 executable rules from a 7,023-rule library, groups what fires into incidents, then investigates each with an AI agent whose every prompt and tool call is fully recorded and replayable; new threat intelligence re-sweeps the history already collected, and nothing reaches a vendor before a human approves. It needs no API key to run: the real CISA KEV (known exploited vulnerabilities) catalog is in place minutes after boot; it also ships an MCP server for Claude, Cursor and Continue. Startup is one command, make up (Docker Compose v2, 8 GB memory, 20 GB free disk; the first run downloads a ~2 GB model), under MIT.

Why it’s worth knowing

• Security operations centers have long been expensive and closed; this project turns “AI agents doing first-line triage, fully auditable” into a complete system you can self-host and run — a strong reference implementation for studying security agents in practice
• The “every step replayable” design is worth borrowing for anyone building agents: an agent erring in a sensitive setting is not the scary part — the scary part is not being able to say why it did what it did, and AiSOC builds auditing into the architecture
• It fits a no-card preference: self-hosted, no API key required; but it is not small (a Docker stack plus a ~2 GB model), so it suits people with a server or a serious interest in security agents more than anyone looking for a lightweight utility