sochub is a multi-tenant incident-response workbench. Triage cases, link IOCs across investigations and run MITRE-mapped playbooks, with an AI copilot on your model that never writes without your confirm.
Not a ticketing system wearing a security costume. Cases, artifacts and IOCs are first-class objects that link across investigations.
A context-aware assistant on a local Ollama model (or your own provider). It proposes actions; nothing is written until you confirm.
Every new case gets a suggested severity, tags, playbook, related cases and next steps — before an analyst opens it.
MITRE-mapped IR playbooks fill a case with phase-grouped tasks. Link a task to a workflow: one click runs it, and the result lands on the task.
A force-directed map of cases, artifacts and IOCs that surfaces the campaign hiding across "unrelated" cases.
One account, many tenants, a role per tenant. Row-level isolation and per-tenant SAML SSO for MSSPs and multi-entity orgs.
A visual builder with conditions, loops, HTTP calls, "was this you?" over Slack or email, and templates for CrowdStrike, SentinelOne, Okta, Entra and more. Dry-run before you ship.
Expiring, auditable rules auto-dismiss known noise at ingest. Preview before saving; "Suppress similar" builds one from an alert.
Jira, HaloPSA and ConnectWise, per tenant and two-way: tickets open from cases, and status and comments flow back.
Every client you work in on one screen: SLA breaches, unassigned work, one merged queue, and weekly client summaries.
Protected VIPs, servers and ranges, daily and per-case caps, and a release ledger. Automation never contains what it shouldn't.
AI-drafted, analyst-edited reports with TTD/TTC/TTR and swimlane timelines. Export to TLP-marked PDF or JSON.
Argon2, TOTP MFA, session revocation, host-bound workflow secrets, SSRF guards and full audit logging.
Real screenshots from the current build. Every one of these runs on your own infrastructure.
Clone the repo, copy the two .env.example files, and go. Then open http://localhost and sign in.
Going to production? Set ENVIRONMENT=production and strong secrets — the app refuses to boot with defaults. Full guide →
$ docker compose up -d --build $ docker compose exec backend alembic upgrade head $ docker compose exec backend python -m app.scripts.create_super_admin --email admin@example.com --name "Super Admin" There is no paid tier. You run it, you own the data, and you can fork it if the roadmap stops matching yours.
| sochub | SaaS | |
|---|---|---|
| Read every line making decisions about your incidents | ||
| Case data, IOCs and prompts stay on your network | ||
| AI on a local model — no third-party API required | ||
| Multi-tenant with per-tenant SSO, no "enterprise tier" | ||
| Per-seat pricing that grows with your team |
Every feature. Every tenant. Forever.
How sochub gets built, and the detection, response and AI-security thinking behind it.
sochub is now open source. The latest round was built mostly by describing features in plain English to an AI agent — here's what that actually looked like, including the parts where the vibe broke and judgment had to take over.
A multi-tenant, AI-assisted SOC case management system built for security teams that have outgrown Jira but can't justify the enterprise SIEM-adjacent platforms.
Building the infrastructure that turns raw cloud logs into actionable intelligence — from ingest pipelines to AI-powered signals and GitOps-managed detection rules.
Questions, feature ideas, bug reports or "we tried it and here's what broke" — all welcome. Submitting opens a pre-filled GitHub issue so the conversation happens in the open.