Last updated: 11/8/2026Last verified: 2026-11-02
<p>Open-source, self-hostable AI Security Operations Center that ingests security telemetry, investigates incidents with auditable agents, and proposes responses for human approval.</p><ul><li>Security telemetry ingestion, detection, correlation, and alert triage</li><li>Multi-agent incident investigation grounded in security evidence</li><li>Replayable ledger recording prompts, tool calls, citations, and decisions</li><li>Self-hosted deployment with human approval before response actions</li></ul>
Details
Platform
WebLinuxAPI
Features
- Security telemetry ingestion, detection, correlation, and alert triage
- Multi-agent incident investigation grounded in security evidence
- Replayable ledger recording prompts, tool calls, citations, and decisions
- Self-hosted deployment with human approval before response actions
Languages
en
Best for
Security teams wanting an auditable AI-assisted investigation workbenchOrganizations that need self-hosted or air-gapped SOC experimentationDevelopers evaluating approval-gated agent workflows for incident response
Known limitations
- Self-hosted software requires operating connectors, databases, search infrastructure, and model services
- AI investigation and triage outputs still require security-analyst review before action
- The project is a fast-moving open-source stack, so deployment and feature scope may change
Alternatives
Handit.ai — Agent reliability monitoring rather than a full security-operations platform
Wazuh — Established open-source security monitoring stack without the same agentic investigation layer
