How beenuar/aisoc works
AiSOC is a self-hostable AI security operations center. Its central workflow takes pushed or polled security telemetry through normalization and Kafka, detection and alert fusion, then AI investigation with auditable reasoning; human approval gates response actions. Separate product branches provide threat-intelligence ingestion and historical hunting, while the web console exposes alerts, cases, detections, playbooks, compliance, and operational views. The README documents stages and capabilities beyond the sampled code; arrows for those stages reflect that documentation, not inspected implementations.
Main entry points: fusion_engine.py Alert Fusion · investigator.py AI Investigation · page.tsx Human Approval · api.ts Web API Client
Components 21
Telemetry Intake
- Connector Polling
services/connectors/app/ingest_client.py - Ingest And Normalize
- Event Kafka
Detection And Triage
- Detection Rules
services/api/app/services/rule_engine.py - Alert Fusion
services/fusion/app/services/fusion_engine.py - Alert And Incident Data
Investigation And Response
- AI Investigation
plans/cyble-aisoc/platform/backend/app/agents/investigator.py - Investigation Ledger
- Human Approval
apps/web/src/app/(responder)/responder/approvals/page.tsx - Playbook Execution
services/agents/app/playbook/engine.py - Response Integrations
Threat Intelligence
- Threat Feeds
- IOC Processing
services/threatintel/app/feeds/pipeline.py - Intel Indexes
- Threat Hunting
services/agents/app/hunt/engine.py
SOC Console
- Web SOC Console
apps/web/src/app/(app)/dashboard/page.tsx - Mobile Responder
apps/mobile/app/index.tsx - Web API Client
apps/web/src/lib/api.ts - Case Replay
apps/web/src/components/cases/replay/useReplayController.ts
Other components
- Security Tools
- SOC Analyst
Connections 22
- Security Tools → Ingest And Normalize: pushes events
- Security Tools → Connector Polling: provides telemetry
- Connector Polling → Ingest And Normalize: forwards normalized events
- Ingest And Normalize → Event Kafka: queues events
- Event Kafka → Detection Rules: carries events
- Detection Rules → Alert Fusion: produces matches
- Alert Fusion → Alert And Incident Data: records alerts
- Alert Fusion → AI Investigation: triggers investigation
- AI Investigation → Investigation Ledger: records reasoning
- AI Investigation → Human Approval: proposes response
- SOC Analyst → Human Approval: reviews actions
- Human Approval → Playbook Execution: authorizes execution
- Playbook Execution → Response Integrations: runs response steps
- Threat Feeds → IOC Processing: supplies indicators
- IOC Processing → Intel Indexes: indexes indicators
- Intel Indexes → Threat Hunting: provides intel
- Web SOC Console → Web API Client: uses API client
- Mobile Responder → Web API Client: uses API client
- Web API Client → Alert And Incident Data: reads SOC data
- SOC Analyst → Web SOC Console: operates console
- SOC Analyst → Mobile Responder: triages incidents
- Case Replay → Investigation Ledger: replays events