最后更新：11/8/2026最后核验：2026-11-02
<p>AiSOC 把"AI 分析师 + 人工审批"引入安全运营流程：接入终端、网络、身份等安全遥测数据后，系统进行检测与关联，再由多个智能体对告警展开调查——每个智能体的提示词、工具调用和推理依据都写入可回放的账本，处置建议（隔离主机、封禁 IP 等）必须由人批准后才会执行。项目采用 MIT 许可、完全自托管，可以放在内网或离线环境运行；官方提供自托管演示、公共评测基线和文档。需要承担的成本主要是运维：连接器、数据库、检索基础设施和模型服务都要自己跑；AI 输出仍需安全分析师复核，项目本身也在快速迭代。适合想要可审计 AI 辅助研判工作台的安全团队、需要内网/离线部署的组织，以及评估审批门控智能体工作流的开发者。本文依据官方 GitHub 仓库、文档站与许可证核验，未部署实例。</p><ul><li>安全遥测接入、检测、关联与 AI 智能体分诊/调查</li><li>智能体提示词、工具调用与依据全部留痕，可回放审计</li><li>响应动作需人工批准，支持自托管与离线环境</li><li>MIT 开源，需自行运维连接器、数据库与模型服务</li></ul>
详情
平台
网页版LinuxAPI
功能特性
- Security telemetry ingestion, detection, correlation, and alert triage
- Multi-agent incident investigation grounded in security evidence
- Replayable ledger recording prompts, tool calls, citations, and decisions
- Self-hosted deployment with human approval before response actions
支持语言
en
适合人群
Security teams wanting an auditable AI-assisted investigation workbenchOrganizations that need self-hosted or air-gapped SOC experimentationDevelopers evaluating approval-gated agent workflows for incident response
已知限制
- Self-hosted software requires operating connectors, databases, search infrastructure, and model services
- AI investigation and triage outputs still require security-analyst review before action
- The project is a fast-moving open-source stack, so deployment and feature scope may change
替代工具
Handit.ai — Agent reliability monitoring rather than a full security-operations platform
Wazuh — Established open-source security monitoring stack without the same agentic investigation layer
