Vigil SOC

A self-hosted AI SOC that investigates alerts, automates containment with human review thresholds, and works with local Ollama models or remote LLMs.

Vigil SOC is an open source AI SOC for security teams that want agents to investigate alerts and carry out incident response within their own environment. It connects investigations, containment, and reporting through editable playbooks.

Investigation workflows: Specialist agents triage findings, correlate evidence, trace root causes, and produce incident reports with timelines and MITRE ATT&CK mappings.
Controlled response: Continuous monitoring can trigger containment actions such as WAF blocks or session revocation, with configurable confidence thresholds deciding when a human must review them and an audit trail recording each action.
Threat hunting and detection: Hypothesis-driven hunts test defenses against MITRE ATT&CK, while Sigma, Splunk, Elastic, and KQL rules support coverage analysis and gap identification.
Connected security tools: MCP integrations give agents access to security systems and services such as VirusTotal, Shodan, Jira, and Slack; cloud incident workflows cover AWS, Azure, and GCP.
Inspectable cases and playbooks: Analysts can update cases through chat, inspect agent reasoning, and modify Markdown workflows to match their team's response process.

Vigil is free under Apache 2.0 and runs locally with Docker, with a browser interface. It supports local Ollama models and remote LLM providers through Bifrost, with Claude as the default backend. Core functionality has no cloud dependency; choosing a remote model or external MCP service sends the affected requests outside your environment. PostgreSQL with pgvector stores state locally by default. DeepTempo's LogLM integration is optional.