Open source · self-hosted · local AI

Investigate
on your terms.

SOC case management with a copilot that asks first

sochub is case management for security incidents. Triage alerts into cases, link IOCs across investigations and run MITRE-mapped playbooks, with an AI copilot on your model that never writes without your confirm. It isn't a SIEM: your SIEM, EDR and email security keep detecting, and sochub is where the incident gets worked.

Get it on GitHubTry the live demoQuick start
Self-hosted
100%Self-hosted
Bytes sent to a 3rd-party LLM
0Bytes sent to a 3rd-party LLM
Every feature, free
$0Every feature, free
Case managementInvestigation copilot
MITRE playbooksResponse workflows
localhost / dashboard
sochub operations dashboard with case trends, severity heatmap and MTTR
Built onFastAPIReact 19PostgreSQLOllamaDocker
Features

Built around how investigations actually work

Not a ticketing system wearing a security costume. Cases, artifacts and IOCs are first-class objects that link across investigations.

Investigation copilot

A context-aware assistant on a local Ollama model (or your own provider). It proposes actions; nothing is written until you confirm.

AI triage

Every new case gets a suggested severity, tags, playbook, related cases and next steps — before an analyst opens it.

Playbooks that run

MITRE-mapped IR playbooks fill a case with phase-grouped tasks. Link a task to a workflow: one click runs it, and the result lands on the task.

Investigation graph

A force-directed map of cases, artifacts and IOCs that surfaces the campaign hiding across "unrelated" cases.

Alongside your SIEM

Not a SIEM and not a replacement: sochub doesn't collect logs or run detections. Alerts from your SIEM, EDR and email security arrive by webhook or scheduled pull; the investigation happens here.

Workflows

A visual builder with conditions, loops, HTTP calls, "was this you?" over Slack or email, and templates for CrowdStrike, SentinelOne, Okta, Entra and more. Dry-run before you ship.

Alert suppression

Expiring, auditable rules auto-dismiss known noise at ingest. Preview before saving; "Suppress similar" builds one from an alert.

Ticketing / PSA sync

Jira, HaloPSA and ConnectWise, two-way, per case task: closing the ticket ticks the task, and the task's result goes back to the ticket.

Containment guardrails

Protected VIPs, servers and ranges, daily and per-case caps, and a release ledger. Automation never contains what it shouldn't.

Incident reports

AI-drafted, analyst-edited reports with TTD/TTC/TTR and swimlane timelines. Export to TLP-marked PDF or JSON.

Multiple organizations

Optional: run several organizations, or keep some departments' incidents apart, each with its own data, roles and SSO. Work in more than one? See them together, with weekly summaries.

Security first

Argon2, TOTP MFA, session revocation, host-bound workflow secrets, SSRF guards and full audit logging.

Product tour

See it before you deploy it

Real screenshots from the current build. Every one of these runs on your own infrastructure.

localhost · recorded session
sochub Cases: AI triage, SLA status, the owner and the incident at a glance.
CasesAI triage, SLA status, the owner and the incident at a glance.
sochub Activity: One story per case: investigation events, notes, ticket comments and changes, in time order.
ActivityOne story per case: investigation events, notes, ticket comments and changes, in time order.
sochub Tasks: Playbook tasks can run a workflow; the workflow records its result on the task and ticks it.
TasksPlaybook tasks can run a workflow; the workflow records its result on the task and ticks it.
sochub Containment: Artifacts, assets and every automated containment: active, refused by policy, or released.
ContainmentArtifacts, assets and every automated containment: active, refused by policy, or released.
sochub Organizations: Optional, for people in several organizations or departments: SLA breaches, unassigned work and one combined queue.
OrganizationsOptional, for people in several organizations or departments: SLA breaches, unassigned work and one combined queue.
sochub Suppression: Expiring, auditable rules for known noise, with hit counts. A used rule can only be disabled.
SuppressionExpiring, auditable rules for known noise, with hit counts. A used rule can only be disabled.
sochub Board: Drag cases across statuses; tags and SLA on every card. ⌘K jumps anywhere.
BoardDrag cases across statuses; tags and SLA on every card. ⌘K jumps anywhere.
sochub Copilot: Chat about a case; approve or cancel each proposed action.
CopilotChat about a case; approve or cancel each proposed action.
sochub Graph: Dashed bridges show where the same indicator links cases.
GraphDashed bridges show where the same indicator links cases.
sochub Playbooks: Import MITRE-mapped playbooks and own editable copies.
PlaybooksImport MITRE-mapped playbooks and own editable copies.
sochub Workflows: Typed node inspectors, dry runs and full run history.
WorkflowsTyped node inspectors, dry runs and full run history.
sochub Reports: Detection → containment → recovery timelines, TLP-marked export.
ReportsDetection → containment → recovery timelines, TLP-marked export.
sochub IOCs: Enriched via VirusTotal, URLhaus, ThreatFox, RDAP and crt.sh — TLP-aware.
IOCsEnriched via VirusTotal, URLhaus, ThreatFox, RDAP and crt.sh — TLP-aware.
Quick start

Running locally in three commands

Clone the repo, copy the two .env.example files, and go. Then open http://localhost and sign in.

FastAPISQLAlchemy asyncPostgreSQLReact 19TypeScriptTanStack QueryTailwindCelery + RedisOllamaSAML SSODocker Compose

Going to production? Set ENVIRONMENT=production and strong secrets — the app refuses to boot with defaults. Full guide →

~/soc-hub
  1. 01Bring up the stack
    $ docker compose up -d --build
  2. 02Apply migrations
    $ docker compose exec backend alembic upgrade head
  3. 03Create the first admin
    $ docker compose exec backend python -m app.scripts.create_super_admin --email admin@example.com --name "Super Admin"
Open source

Open source. Self-hosted. Yours.

sochub is software you install and run on your own infrastructure. There is no hosted or SaaS version, no account to sign up for and no paid tier: you own the data, and you can fork it if the roadmap stops matching yours.

sochubSaaS tools
Read every line making decisions about your incidents
Case data, IOCs and prompts stay on your network
AI on a local model — no third-party API required
SSO, MFA and multiple organizations, no "enterprise tier"
Per-seat pricing that grows with your team

Compared with typical hosted (SaaS) case-management tools. sochub itself is only offered as self-hosted software.

Self-hosted
$0

Every feature, on your own servers. Free, forever.

  • Unlimited users & organizations
  • Copilot, triage & reports
  • Playbooks & automations
  • SAML SSO & MFA
Clone the repo
From the build log

Articles

How sochub gets built, and the detection, response and AI-security thinking behind it.

·SOC

From Alert to Closed Case Without Leaving sochub

How a threat goes from a SIEM or EDR detection to a contained, documented, closed incident inside one platform — and how to onboard those tools in an afternoon.

8 min readRead
All articles
Contact

Tell us what your SOC needs

Questions, feature ideas, bug reports or "we tried it and here's what broke" — all welcome. Submitting opens a pre-filled GitHub issue so the conversation happens in the open.

Issues are public — don't paste case data or secrets. Requires a GitHub account.