beenuar/AiSOC
AiSOC shows how a security agent can investigate alerts through typed tools, record its steps in an auditable ledger, and require human approval before response actions. Its shipped local model is useful for trying the flow without API keys.
AiSOC ingests security events, runs detection and correlation, then sends incidents to an agent that uses typed tools and records prompts, calls, citations, and verdicts in an **Investigation Ledger**. The project lists **87 connectors** and ships with a local **Llama 3.2 3B** model; response playbooks default to preview.
No separate implication has been recorded yet.
AiSOC ingests security events, runs detection and correlation, then sends incidents to an agent that uses typed tools and records prompts, calls, citations, and verdicts in an **Investigation Ledger**. The project lists **87 connectors** and ships with a local **Llama 3.2 3B** model; response playbooks default to preview.
AiSOC applies an agent harness to security investigations: typed tools, a recorded investigation ledger, and preview-first playbooks make tool use and findings inspectable. Its local model and connector breadth show a packaged implementation, while the supplied brief does not establish detection quality or operational reliability. The ledger and preview defaults address auditability and review, but do not alone settle authorization or uncertain outcomes from external actions.