Data source: the GitHub Trending bot issue happydog-intj/ai-xiaohongshu-daily #617 (“GitHub Trending AI 早报 · 2026-11-02”, 02:00 slot), compared with the previous day’s #614 (11-01, 01:00 slot). Primary metric: stars today. Repos with 40k+ total stars, long-running chart leaders, slowing repos and non-AI repos are excluded.
beenuar/AiSOC — +436 ⭐ today
https://github.com/beenuar/AiSOC
Total stars: 6,039 · vs. previous day: new entry (not on yesterday’s list; 7.2% of total) · Language: Python (with TypeScript tooling) · License: MIT
AiSOC is an open-source, self-hostable AI Security Operations Center: it ingests security telemetry, detects and correlates threats, has AI agents investigate them, and proposes responses that a human approves. The pipeline runs from event normalization (Kafka) through detection and fusion (2,530 executable detection rules plus 76 sliding-window rules, with per-tenant tuning), correlation of alerts into incidents, LLM-agent triage and investigation, and finally playbooks and response, with every agent’s reasoning, prompts and tool calls written to a replayable “Investigation Ledger.” State lives in Postgres, events in Kafka, the event lake and hunting in ClickHouse, and the entity graph in Neo4j, while the LLM gateway ships with a quantized Llama 3.2 3B model on Ollama so it runs without API keys. Key features:
- Alert fusion and incident correlation with MITRE ATT&CK-oriented investigation
- LLM-agent triage with grounding checks that route unsupported verdicts to human review
- Replayable decision ledger and signed evidence bundles (OCSF 1.9.0)
- Scheduled hunts and retro-hunts over stored data, fed by the CISA KEV catalog
- 87 connectors (Splunk, Sentinel, Elastic, CrowdStrike, Okta, AWS, Kubernetes and more) and an SPL/KQL/EQL rule translator (aisoc-migrate)
- SAML/OIDC, SCIM 2.0, TOTP MFA, RBAC, and an MCP server for Claude, Cursor and Continue
It lets teams try the whole loop, from detection to agent investigation to approval-gated response, without a commercial SIEM or SOAR, and it stands apart from typical AI security demos in that autonomy is off by default and every decision is recorded in the ledger. With agent security and the “AI SOC” now hot topics, a complete MIT-licensed reference with a local model and MCP integration appears to explain the surge (the README itself says it is not a drop-in SIEM replacement and only some capabilities are marked Stable).
Practical use: Port existing SIEM rules with aisoc-migrate and run them in the demo profile to show customers an “AI triage plus human approval” SOC proof of concept without commercial licenses.
Tags: #AISOC #SecurityOperations #ThreatHunting #MITREATTACK #AgenticSecurity #MCP
Excluded today
- thedotmack/claude-mem (+1,527, 108.9k): over the 40k-star limit.
- lightpanda-io/browser (+827, 39.9k): long-running chart leader with repeated #1 language-trending history.
- Donchitos/Claude-Code-Game-Studios (+970, 32.0k): down 28% from yesterday’s +1,347, so momentum is slowing.
- cjpais/Handy (+383, 36.3k): only 1.1% of its total, a large repo that trends repeatedly.
- kornia/kornia (+88): negligible growth.
Leave a Reply