Build a security operations center that reduces alert noise and logs AI reasoning transparently
Sorting real threats from the thousands of alerts security teams face daily still relies on human judgment. This repository provides a system that collects alerts, has an AI agent investigate them, and records all decision bases as auditable logs. It runs locally without external API keys, allowing you to control the core security operations workflow on your own server.
Flow from alert to response
Generated alerts are grouped into incidents by related items, which an AI agent then investigates. The agent records all tool calls and prompts, ultimately proposing a response plan. At this stage, every step requires human approval to become an actual action. When new threat information arrives, the system rescans previously collected data to find missed traces.
Transparent judgment and audit records
AI judgment does not simply display results. The 'investigation ledger' details what data the agent viewed, which tools it called, and the basis for its conclusions. This record can be exported as a signed evidence bundle for later verification of judgment appropriateness or auditing. The system is also designed to automatically switch to human review if the AI makes unsupported claims, preventing incorrect automated processing.
Local models and data connections
The system does not rely on external cloud APIs and uses a local language model of approximately 2GB by default. This reduces network costs and data leakage concerns, and is optimized for inference on CPU alone. Data connections support 91 click-based connectors, allowing direct retrieval of logs from major security and cloud platforms such as Splunk, CrowdStrike, and AWS. It also includes a tool to convert existing detection rules, enabling the reuse of assets from previous environments.
Pre-deployment checks
This system is not a SIEM replacement but a tool that assists with alert correlation and investigation processes. Unconnected data is not visible, and automated responses do not function without explicit policies and human approval. It requires Docker Compose v2, at least 8GB of memory, and 20GB of disk space, with an initial model download of approximately 2GB. Released under the MIT license for free use, but production stability should be verified by checking the test status of each feature.
