soc-ai triages the alerts on your Security Onion grid with a large language model that you host yourself. For each alert it pulls the related events, checks the indicators against local threat intel and decodes the packets if the payload matters. Then it gives you a verdict, a confidence number and the reasoning behind them.
Security Onion Solutions, LLC has no affiliation with soc-ai and does not endorse it. soc-ai is a separate service. It reads a grid that you already run.
Try the live demo first. It needs no install and no login. The same demo runs on your own host in 5 minutes. It needs no Security Onion grid and no model.
docker compose -f docker-compose.demo.yml up --build # then open http://127.0.0.1:8080A full install needs a Linux host with git and curl, network reach to your grid, and a model. The model is a local OpenAI-compatible endpoint or a cloud API key with redacted egress.
git clone https://github.com/nuk3s/soc-ai.git && cd soc-ai
./setup.shsetup.sh checks the connection settings, asks which model to use, builds the image and starts the stack. Then it runs the doctor and prints the URL and the admin password. Open https://<host>:8443/app, sign in as admin and press Investigate on a detection.
Read the Security Onion prerequisites before the first install. People skip two steps there: the firewall pinhole and the audit-log role grant. docs/quickstart.md has the full path from the clone to the first verdict.
- Triage: the agent reads an alert and its related events, enriches the indicators and decodes the PCAP. It writes a verdict with citations.
- Hunts: you type an objective in plain English, and the read-only agent runs it across many hosts and a time window.
- Analytics and leads: analytics run over the grid on a schedule. Hits on one entity form a lead, and the lead starts its own hunt.
- Runbooks: the agent cites the procedures of your own team. The repo ships a starter pack of 10 runbooks.
- Evidence gates: a true-positive or false-positive verdict needs evidence that the run retrieved. A weaker verdict becomes
needs_more_info. - Write-backs: the agent recommends an acknowledge, an escalation or a comment. You run it with one click, and soc-ai audits it.
- Privacy: the model runs on your hardware. The optional cloud Oracle is off by default, and it reads redacted input only.
- Operations:
soc-ai doctorchecks every dependency and names the fix.soc-ai backupwrites the store into one file.
The docs site holds the same pages, with search.
- Installation: Quickstart · Security Onion setup · Docker deployment · Bare-metal deployment · Blocklists · Sensor PCAP setup
- Operation: Console guide · Hunting · Agent tools · OQL primer · OQL hunting examples · Test PCAPs
- Design: Architecture · Safety model · Audit chain breaks · Lesser models
- Project: Roadmap · Release notes 1.6.0, 1.5.3, 1.5.2, 1.5.1 and 1.5.0 · Changelog · Security policy
- Blog: soc-ai hunts on its own now · Getting an LLM to show its work
Release 1.6 is the current release. soc-ai records each span of time when grid data is missing, and it shows that grid gap to the operator. The sweeps do not score the hours of a gap. The operator can act on waiting actions from one list and on many leads with one press. Release 1.7 joins related leads into a campaign and validates the lead thresholds. docs/ROADMAP.md has the full plan, and CHANGELOG.md has every version.
Read CONTRIBUTING.md. It covers the dev setup, the checks that CI runs and the writing style.
Apache 2.0. See LICENSE.