sochub is a multi-tenant incident-response workbench. Triage cases, link IOCs across investigations and run MITRE-mapped playbooks, with an AI copilot on your model that never writes without your confirm.
Not a ticketing system wearing a security costume. Cases, artifacts and IOCs are first-class objects that link across investigations.
A context-aware assistant on a local Ollama model (or your own provider). It proposes actions; nothing is written until you confirm.
Every new case gets a suggested severity, tags, playbook, related cases and next steps — before an analyst opens it.
MITRE-mapped IR playbooks that fill a case with phase-grouped task checklists, from identification to lessons learned.
A force-directed map of cases, artifacts and IOCs that surfaces the campaign hiding across "unrelated" cases.
One account, many tenants, a role per tenant. Row-level isolation and per-tenant SAML SSO for MSSPs and multi-entity orgs.
A visual workflow builder with conditions, loops, HTTP calls and Slack "ask a person" steps. Dry-run before you ship.
AI-drafted, analyst-edited reports with TTD/TTC/TTR and swimlane timelines. Export to TLP-marked PDF or JSON.
Argon2, TOTP MFA, session revocation, host-bound workflow secrets, SSRF guards and full audit logging.
Real screenshots from the current build. Every one of these runs on your own infrastructure.
Clone the repo, copy the two .env.example files, and go. Then open http://localhost and sign in.
Going to production? Set ENVIRONMENT=production and strong secrets — the app refuses to boot with defaults. Full guide →
$ docker compose up -d --build $ docker compose exec backend alembic upgrade head $ docker compose exec backend python -m app.scripts.create_super_admin --email admin@example.com --name "Super Admin" There is no paid tier. You run it, you own the data, and you can fork it if the roadmap stops matching yours.
| sochub | SaaS | |
|---|---|---|
| Read every line making decisions about your incidents | ||
| Case data, IOCs and prompts stay on your network | ||
| AI on a local model — no third-party API required | ||
| Multi-tenant with per-tenant SSO, no "enterprise tier" | ||
| Per-seat pricing that grows with your team |
Every feature. Every tenant. Forever.
How sochub gets built, and the detection, response and AI-security thinking behind it.
sochub is now open source. The latest round was built mostly by describing features in plain English to an AI agent — here's what that actually looked like, including the parts where the vibe broke and judgment had to take over.
A multi-tenant, AI-assisted SOC case management system built for security teams that have outgrown Jira but can't justify the enterprise SIEM-adjacent platforms.
Building the infrastructure that turns raw cloud logs into actionable intelligence — from ingest pipelines to AI-powered signals and GitOps-managed detection rules.
Questions, feature ideas, bug reports or "we tried it and here's what broke" — all welcome. Submitting opens a pre-filled GitHub issue so the conversation happens in the open.