The AI security analyst that leaves a paper trail

What it does

AiSOC ingests security events—from Sysmon and CloudTrail to Kubernetes audit logs—correlates them through a Neo4j graph, and runs AI-driven investigations via a LangGraph orchestrator. The results surface in a web console with workbenches for triage, case queues, and rule tuning. The entire stack runs on your own infrastructure with no callbacks to a vendor cloud.

The interesting bit

The Investigation Ledger stores every LLM prompt, response, cited evidence, and downstream tool call step-by-step, making investigations replayable later. This is paired with a public CI eval harness that gates pull requests against synthetic incident datasets and noisy alert streams, so the project measures its own consistency rather than asking you to take its word.

Key highlights

• The orchestrator is a ~600-line LangGraph in services/agents/, small enough to read end-to-end
• Four specialized agents—DetectAgent, TriageAgent, HuntAgent, and RespondAgent—handle the funnel
• A natural-language /hunt surface generates ES|QL, SPL, or KQL templates without writing raw queries
• Neo4j entity graph with 17 node labels and 14 edge types built inline during Kafka ingest
• Weekly public benchmark scoreboard with substrate and wet-eval rows kept strictly separate

Caveats

• The live demo at tryaisoc.com runs on a maintainer’s local machine via Cloudflare Tunnel and can vanish without warning
• Benchmark scoreboard explicitly separates substrate self-consistency numbers from live agent performance, so the CI gates measure template fidelity, not real-world catch rates

Verdict

Security teams fed up with opaque, cloud-tethered AI tools should look here; if you need a managed SaaS with an SLA, this is not it.