"Most security tools alert you. A-SOC acts."
A-SOC is a cloud-native security operations platform that autonomously detects, investigates, and remediates threats using a coordinated fleet of specialized LLM-powered agents — with policy enforcement and human governance built in.
Quick Start · Architecture · Testing · Deployment
Traditional SOCs drown in alerts: thousands of low-fidelity events per day, static rules that miss novel attacks, slow manual investigation, and compliance paperwork that lags behind reality.
A-SOC replaces that with an agent fleet that ingests telemetry, scores risk with LLM reasoning, consults policy-as-code (OPA) on every decision, and executes remediation — escalating anything high-risk to a human operator before it runs.
What works today (all verified in CI — see Testing):
| Capability | Implementation |
|---|---|
| Multi-agent fleet | 7 specialized agents: Telemetry, Detection, Supervisor, Forensics, Response, Compliance, Notification |
| LLM-powered analysis | OpenAI, Anthropic, DeepSeek, or Ollama (local llama3); falls back to a deterministic mock provider when no API key is set, so the platform runs out of the box |
| Real-time threat feed | Native WebSocket stream (/ws/threat-feed) with client commands START_SIMULATION, APPROVE_ACTION, STOP_SIMULATION |
| Human-in-the-loop governance | High-risk actions pause for explicit operator authorization in the dashboard before execution |
| Policy-as-Code | OPA/Rego guardrails gate every proposed remediation — role-aware, risk-thresholded, versioned in git |
| Tamper-evident audit trail | HMAC-chained audit records for every action and decision |
| Zero-trust API security | RS256 JWT auth, RBAC (4 roles / 19 permissions), rate limiting |
| Cloud telemetry ingestion | AWS (CloudTrail), GCP, and Azure log providers via boto3 / cloud SDKs |
| Integrations | Slack & Microsoft Teams webhooks, JIRA ticket creation, MITRE ATT&CK mapping, Pinecone vector store |
| Operator dashboard | 7-page Next.js 15 console with live feed, blast-radius graph, approvals, hunting, governance, and forensics views |
| API surface | 22 REST endpoints (FastAPI) + WebSocket, interactive docs at /docs |
| Layer | Technology | Version | Role |
|---|---|---|---|
| Backend | FastAPI + Uvicorn | 0.115 | Async REST API & WebSocket server |
LangGraph | 1.2 | Supervisor agent orchestration workflow with checkpointing | |
LangChain | 1.x | LLM abstraction (OpenAI / Anthropic / DeepSeek / Ollama) | |
Open Policy Agent | Rego v1 | Policy-as-Code engine; every remediation is checked against guardrails/policies/ | |
PostgreSQL + Redis | 15 / 7 | Persistent state & caching (asyncpg / redis-py) | |
Docker Compose | 7 services | postgres, redis, opa, ollama, backend, worker, dashboard — with health checks & resource limits | |
| Frontend | Next.js (App Router) | 15.3 | React framework; production build verified in CI (design decisions) |
React | 19.1 | UI library | |
Tailwind CSS | v4 | Utility-first styling | |
Zustand + TanStack Query | 5 / 5 | Client state & server cache | |
framer-motion | 11 | Animations; blast-radius graph uses inline SVG (no chart library) | |
Jest + Testing Library / Playwright | 29 / 1.x | 8 unit tests + 8 E2E spec suites | |
| Quality | pytest + coverage | — | 385 tests (379 passing, 6 skipped) |
black / isort / ESLint | — | Enforced in CI on every push |
A-SOC uses a hub-and-spoke multi-agent model: a central Supervisor orchestrates specialist agents and enforces corporate policy (OPA) on every decision.
┌─────────────────────────────────────────────────────────────────┐
│ A-SOC Agent Platform │
│ │
│ ┌─────────────┐ ┌────────────────────────────────────────┐ │
│ │ Log Sources │ │ Agent Fleet │ │
│ │─────────────│ │ │ │
│ │ CloudTrail │───▶│ ① TELEMETRY AGENT │ │
│ │ VPC Flow │ │ Ingests & normalizes raw log data │ │
│ │ K8s Audit │ │ │ │ │
│ └─────────────┘ │ ▼ │ │
│ │ ② DETECTION AGENT │ │
│ │ Analyzes anomalies │ │
│ │ Assigns Risk Score │ │
│ │ │ │ │
│ │ ▼ │ │
│ │ ③ SUPERVISOR AGENT ◀── OPA Policy │ │
│ │ ┌────────────────────────┐ │ │
│ │ │ Low risk → auto-approve │ │ │
│ │ │ High risk → HITL gate │ │ │
│ │ │ Critical → hard block │ │ │
│ │ └────────────────────────┘ │ │
│ │ │ │ │ │
│ │ ▼ ▼ │ │
│ │ ④ FORENSICS Human Dashboard │ │
│ │ AGENT (Blast Radius + │ │
│ │ (Attack Authorize Modal) │ │
│ │ Graph) │ │ │
│ │ │ │ │ │
│ │ └────┬─────┘ │ │
│ │ ▼ │ │
│ │ ⑤ RESPONSE AGENT │ │
│ │ Executes remediation │ │
│ │ (Block IP, Revoke Keys, etc.) │ │
│ │ │ │ │
│ │ ▼ │ │
│ │ ⑥ COMPLIANCE AGENT │ │
│ │ Maps incident → SOC2 / ISO 27001 │ │
│ │ Logs cryptographic evidence │ │
│ └────────────────────────────────────────┘ │
│ ⑦ NOTIFICATION AGENT │
│ Slack / Teams webhooks, JIRA │
└─────────────────────────────────────────────────────────────────┘
| Agent | Role |
|---|---|
| ① Telemetry | Ingests and normalizes logs from AWS CloudTrail, GCP Cloud Logging, and Azure Monitor into a unified event schema (demo provider runs without credentials). |
| ② Detection | LLM-powered anomaly detection and correlation; assigns a continuous risk score and maps findings to MITRE ATT&CK techniques. |
| ③ Supervisor | The orchestrator. Routes every detection through OPA policy: low risk auto-approves, high risk escalates to human approval, critical actions hard-block. Enforces quality gates on agent output (confidence, completeness) with retry-then-escalate behavior. |
| ④ Forensics | Builds the blast radius — the set of resources touched, compromised, or at risk — and persists artifacts to the vector index. |
| ⑤ Response | Executes approved remediation playbooks (IP block, IAM revocation, quarantine) with an explicit target/reason contract. |
| ⑥ Compliance | Maps incidents to SOC 2 / ISO 27001 controls and writes HMAC-chained, tamper-evident audit records. |
| ⑦ Notification | Fans approved incidents out to Slack / Microsoft Teams webhooks and opens JIRA tickets. |
Defense-in-depth applied to the platform itself:
- Least privilege per agent — agents only get the tools their role allows; the Compliance agent cannot execute remediations.
- Human-in-the-loop for high-stakes actions — IAM revocation, firewall changes, and instance termination require explicit operator authorization; if OPA is unreachable, a local guardrail still blocks high-risk destructive actions (and every fallback decision is logged).
- Policy-as-Code — governance lives in versioned, reviewable Rego files under
a-soc/guardrails/policies/, tested in CI like any other code. - Zero-trust API — RS256 JWT access/refresh tokens, 4-role RBAC (
readonly/analyst/supervisor/adminwith 19 distinct permissions), rate limiting on sensitive routes, and a separate WebSocket token (WS_API_TOKEN). - Tamper-evident audit — every action is hash-chained with HMAC, so silent log edits are detectable.
- Secure defaults in configuration — secrets come from environment variables;
.env.exampleships with non-production defaults that CI and docker health checks verify.
- Python 3.11+ (CI runs on 3.12)
- Node.js 20+
- Docker & Docker Compose (recommended)
- Optional: an API key for OpenAI / Anthropic / DeepSeek, or a local Ollama server — without one, A-SOC runs on a deterministic mock LLM provider
git clone https://github.com/Ismail-2001/Autonomous-Secure-AI-Operations-Center.git
cd Autonomous-Secure-AI-Operations-Center/a-soc
cp .env.example .env # add an LLM API key if you have one (optional)
docker compose up -d
docker compose ps # all 7 services should become healthy- Dashboard: http://localhost:3000
- API + interactive docs: http://localhost:9002/docs
git clone https://github.com/Ismail-2001/Autonomous-Secure-AI-Operations-Center.git
cd Autonomous-Secure-AI-Operations-Center/a-soc
# Backend
python -m venv venv
source venv/bin/activate # Windows: venv\Scripts\activate
pip install -e ".[dev]" # same install CI uses
cp .env.example .env # optional — mock provider works with no key
python -m uvicorn src.asoc.api.app:app --host 0.0.0.0 --port 9002
# Frontend (in a second terminal)
cd dashboard
npm install
npm run dev # http://localhost:3000| Variable | Purpose |
|---|---|
LLM_PROVIDER |
openai | anthropic | deepseek | ollama (falls back to mock if no key) |
OPENAI_API_KEY / ANTHROPIC_API_KEY / DEEPSEEK_API_KEY |
Provider credentials |
LOCAL_LLM_MODEL / LOCAL_LLM_BASE_URL |
Ollama model (default llama3) and URL |
DATABASE_URL / REDIS_URL |
PostgreSQL (asyncpg) and Redis connection strings |
OPA_URL |
Policy engine endpoint (default http://localhost:8181) |
HMAC_SECRET |
Signing key for the tamper-evident audit chain |
WS_API_TOKEN |
Token required by the /ws/threat-feed WebSocket |
AWS_* / GCP_* / AZURE_* |
Cloud telemetry credentials (optional) |
Full list: a-soc/.env.example (51 variables).
- Open http://localhost:3000 and sign in (seeded dev credentials:
admin/admin123— change them outside local dev). - Click Start Simulation to stream synthetic threat telemetry through the fleet.
- Watch detections appear with risk scores; inspect the blast radius graph.
- When a high-risk action is proposed, review context in the authorize modal and approve to execute — or deny.
- Audit every action under Governance.
Every gate below runs in CI (.github/workflows/ci.yml) on each push to main:
| Gate | Command | Current result |
|---|---|---|
| Python test suite | pytest tests/ |
379 passed, 6 skipped |
| Statement coverage | pytest tests/ --cov |
51% |
| OPA policy tests | opa test guardrails/policies -v |
25 passed |
| Frontend unit tests | npm test |
8 passed |
| Formatting | black --check / isort --check |
clean (154 files) |
| Frontend lint | npm run lint (ESLint 9) |
0 errors |
| Production build | npm run build |
passes (7 routes) |
| E2E | npx playwright test (8 spec suites) |
runs in CI against the full stack |
| Deployment verification | docker compose up + smoke checks |
health checks for all 7 services |
Quick local run:
# Backend
cd a-soc
python -m pytest tests/ -q --cov
# Policies (requires opa on PATH)
cd guardrails/policies && opa test . -v && cd ../..
# Frontend
cd dashboard && npm run lint && npm test && npm run buildPerformance methodology and results: a-soc/BENCHMARKS.md.
Autonomous-Secure-AI-Operations-Center/
├── .github/workflows/ # CI: pytest, black/isort, OPA tests, ESLint, Playwright, compose verify
├── LICENSE
├── README.md
└── a-soc/
├── src/asoc/
│ ├── agents/ # 7 agents (telemetry, detection, supervisor, forensics,
│ │ # response, compliance, notification)
│ ├── api/ # FastAPI app, 22 REST routes, WebSocket endpoint
│ ├── orchestration/ # LangGraph supervisor workflow
│ ├── core/ # config, structured logging, JWT/RBAC, rate limiting
│ ├── llm/ # LLM providers (OpenAI/Anthropic/DeepSeek/Ollama/mock)
│ ├── mitre/ # MITRE ATT&CK technique mapping
│ └── vector/ # Pinecone vector provider
├── guardrails/policies/ # OPA Rego policies + 25 policy tests
├── tests/ # 385 pytest tests (e2e/, performance/)
├── dashboard/ # Next.js 15 operator console (Jest + Playwright)
├── k8s/ # Kubernetes manifests
├── docker-compose.yml # 7-service stack with health checks
├── .env.example # all 51 environment variables, documented
└── DEPLOYMENT.md # production deployment guide
Full guide: a-soc/DEPLOYMENT.md — covers Docker Compose, AWS ECS (Fargate), Kubernetes, Vercel (dashboard only), environment variables, monitoring & logs, scaling, backup/recovery, and security hardening.
| Target | Backend | Frontend | Guide |
|---|---|---|---|
| Docker Compose | ✅ | ✅ | docker compose up -d (7 services) |
| AWS ECS Fargate | ✅ | ✅ S3 + CloudFront | DEPLOYMENT.md |
| Kubernetes | ✅ | ✅ Ingress | a-soc/k8s/ (7 manifests) |
| Vercel | — | ✅ | DEPLOYMENT.md |
| Area | Status |
|---|---|
| Core multi-agent pipeline, HITL, RBAC, audit trail | ✅ Shipped — covered by 379 passing tests |
| OPA policy guardrails | ✅ Shipped — 25 policy tests in CI |
| Dashboard (7 pages), unit tests, lint, production build | ✅ Shipped |
| Playwright E2E (8 specs) + docker-compose smoke verification | ✅ Wired into CI |
| Cloud telemetry providers (AWS / GCP / Azure) | ✅ Implemented |
| Notifications (Slack / Teams / JIRA), MITRE ATT&CK, Pinecone | ✅ Implemented |
Local LLM via Ollama (llama3) |
✅ Implemented |
| Performance benchmarks | ✅ a-soc/BENCHMARKS.md |
Known limitations are tracked in a-soc/CHANGELOG.md.
-
Fork and branch:
git checkout -b feature/your-feature -
Make your change with tests (new agent logic needs pytest coverage; new policies need Rego tests)
-
Run the gates locally before pushing:
cd a-soc python -m pytest tests/ -q black --check --line-length 120 . isort --check-only --profile black --line-length 120 . (cd guardrails/policies && opa test . -v) cd dashboard && npm run lint && npm test
-
Commit using Conventional Commits and open a PR against
main
CI re-runs every gate automatically; PRs with red checks won't merge cleanly.
Distributed under the MIT License — see LICENSE.
Built with obsession for security, AI, and clean architecture.
If A-SOC helped you or inspired your work, consider starring ⭐ the repository.
