Agentic Soc Platform is live · free · last verified 25 Oct 2026 · viability monitor
Agentic Soc Platform
Self-hosted, MIT-licensed Agentic SOC platform that turns SIEM alert floods into AI-investigated cases and playbook runs.
ASP treats LLM triage as a first-class step rather than a bolted-on dashboard, and it's MIT-licensed and self-hosted, so no per-seat fees and no telemetry leaving your network. The 0.6.0 release adds real operational plumbing — scripted backup/restore/upgrade, Worker Health heartbeats, sanitized playbook run logs — that open-source SOC tools usually never get. Pass if you need pre-wired Jira, Slack, or PagerDuty glue or a support contract with a named escalation path.
Verdict generatedVerified 5d ago · liveness 55/100 · cite: rightaichoice.com/tools/agentic-soc-platform
- SOC analysts buried in alert volume who want an AI-drafted investigation report as a starting point
- MSSPs that need open-source, on-premise SOC tooling without per-seat licensing
- Security engineers fluent in Python and YAML who can adapt modules and write playbooks
- Blue teams running Splunk or ELK that must keep security data inside their own network
- Teams wanting a fully managed cloud SIEM/SOAR with vendor support and SLAs
- Analysts without scripting skills who expect a plug-and-play console
- Shops with no appetite for running their own upgrades, backups, and authentication
We scan live Reddit threads, YouTube comments, X posts, G2 reviews and other communities — and hand you an honest verdict in under a minute.
- Honest verdict, not marketing
- Real pros & cons from real users
- Attributed quotes with receipts
3 free scans · no card needed
Skip ASP if you need vendor-run infrastructure, pre-built ticketing or chat connectors, and a support contract rather than a Python-and-YAML project your own engineers keep running.
The license is free, but the real cost is engineer time: Custom Modules for new SIEM rules and alert sources are Python work you own forever.
ASP is MIT-licensed and self-hosted, so there is no per-seat or per-alert fee to compare — the budget line is infrastructure plus the engineering hours to run and extend it. That makes it cheapest for a small SOC with strong Python skills and expensive for a lean team that would otherwise buy a managed SIEM/SOAR with support included.
In short
Agentic Soc Platform — Self-hosted, MIT-licensed Agentic SOC platform that turns SIEM alert floods into AI-investigated cases and playbook runs. Best for SOC analysts buried in alert volume who want an AI-drafted investigation report as a starting point, MSSPs that need open-source, on-premise SOC tooling without per-seat licensing, Security engineers fluent in Python and YAML who can adapt modules and write playbooks. Free to use.
What is Agentic Soc Platform?
Agentic Soc Platform — Self-hosted, MIT-licensed Agentic SOC platform that turns SIEM alert floods into AI-investigated cases and playbook runs. Best for SOC analysts buried in alert volume who want an AI-drafted investigation report as a starting point, MSSPs that need open-source, on-premise SOC tooling without per-seat licensing, Security engineers fluent in Python and YAML who can adapt modules and write playbooks. Free to use.
ASP (Agentic SOC Platform) is an MIT-licensed, on-premise security operations workspace from developer Funnywolf. It collapses the work normally split across SIEM, SOAR, threat intelligence, and knowledge systems into a single traceable loop: alert intake, case triage, AI investigation, playbook automation, and knowledge capture. Modules stream alerts from Splunk, ELK, or generic webhooks via YAML configuration, extract IOCs, correlate context, and open cases, alerts, and artifacts so raw logs become reviewable security events. On a given case, ASP pulls together alerts, entities, logs, and enrichment results, then drafts an investigation report carrying severity, confidence, impact, priority, verdicts, attack chains, and remediation guidance for an analyst to approve. Playbooks push investigations forward with one click — LLM investigation, knowledge extraction, threat intelligence enrichment, and CMDB enrichment — all under human approval gates, with each run logging start/finish times and a sanitized message stream. The 0.6.0 "Winter is Coming" release added Case Relationships (Related, Duplicate of, Parent of, with 500-character notes and suggestions), a Custom Variables tab with six managed types including protected secrets, and Worker Health heartbeats for the Agentic Module, Case Analysis, Playbook, ELK Action, and Dashboard Cache workers. Governance is covered too: local/LDAP login, user roles, API keys, Inbox notifications, and an audit log. It suits SOC analysts drowning in alert volume, MSSPs avoiding per-seat licensing, and Python-fluent security engineers who must keep telemetry inside their own perimeter. Against managed cloud SIEM/SOAR suites, ASP trades vendor SLAs and pre-built connectors for license freedom and data residency — you bring the engineering.
Key features
- MIT-licensed, self-hosted on-premise deployment via single-host Docker Compose
- SIEM alert intake from Splunk, ELK, or generic webhooks through YAML config
- AI investigation reports with severity, confidence, impact, priority, and verdicts
- Attack chain reconstruction and remediation guidance per case
- Playbooks running LLM investigation with human approval gates
- Case Relationships: Related, Duplicate of, Parent of, with 500-character notes
- Custom Variables tab with six managed types (string, integer, float, boolean, list, dictionary)
- Protected secret variables whose values are never returned by the API
- Worker Health heartbeats across five background workers with an admin Workers page
- Playbook run logs with start/finish times and a sanitized message stream
- Automatic IOC and artifact enrichment with reputation, pulses, and asset context
- CMDB and identity context enrichment around each case
- Knowledge extraction loop turning closed cases into a searchable security knowledge base
- Unified search across Splunk, ELK, and index actions via one YAML-configured interface
- Harness Agent integration through asp-cli and Skills for case, log, and playbook operations
Behind the verdict
We'd reach for ASP when a blue team runs Splunk or ELK, has at least one engineer comfortable in Python and YAML, and faces a hard rule that security data stays on-prem. In that scenario the offer is unusually clean: MIT license, single-host Docker Compose, and an AI investigation loop that drafts severity, confidence, verdicts, and attack chains instead of handing you another empty case queue. The workflow is the selling point. Alerts arrive from Splunk, ELK, or a webhook, get turned into cases with extracted IOCs and enrichment context, and playbooks — LLM investigation, threat intelligence, CMDB enrichment, knowledge extraction — run behind human approval gates. Each run now records start and finish times plus a sanitized message stream, which matters more than it sounds: auditability is what separates a toy AI SOC from one you can defend to a compliance reviewer. Where it bites is the edges. The documented integrations we can confirm are Splunk and Harness — no pre-built Jira, Slack, or PagerDuty plumbing, so ticketing and paging glue is yours to write in Python modules. Teams that expect a plug-and-play console and a vendor phone number will be unhappy. If you don't want to own upgrades, backups, and authentication, a managed suite is the honest answer. Against managed cloud SIEM/SOAR platforms, ASP wins on cost structure and data residency and loses on hand-holding and out-of-the-box connectors. Against a bare open-source SIEM, it wins because the AI investigation and knowledge loop are built into the case workspace rather than stitched on. Pick ASP if you have the engineering muscle; pass if you need a support contract before you deploy. The 0.6.0 operational additions make running it day-to-day noticeably less scary than earlier releases.
Limitations
- ASP is open-source and self-hosted, so you manage deployment, maintenance, and scaling.
- Custom SIEM rules and alert sources require Python; frontend changes need TypeScript.
- Documented integrations are Splunk and Harness, so you write any Jira, Slack, ServiceNow, or PagerDuty glue yourself in Python.
- Single-host Docker Compose is the only officially supported topology, and each background worker supports a single instance — duplicate instances overwrite each other's Worker Health state.
- Release 0.6.0 supports upgrading directly from 0.5.2 only; earlier versions are not supported, no database downgrade is offered, and rollback depends on a backup taken before the upgrade.
- The AI investigation depends on your LLM configuration, so quality varies, and knowledge extraction and playbooks require setup and iteration.
- If Redis is unavailable, the API returns 503 for worker health.
as of 2026-10-20
Researching Agentic Soc Platform? Get your full AI stack in 60 seconds.
Free, no signup — tell us your goal and get tools matched to your budget & existing stack.
Is Agentic Soc Platform still active?
Agentic Soc Platform is live · free · last verified 25 Oct 2026 · viability monitor.
Viability score
How well maintained and how widely used is Agentic Soc Platform? Built from what the vendor actually publishes (docs, changelog, tutorials, integrations, pricing), whether the site is live, and how much real users discuss it. How we calculate this
Last calculated: October 2026
How we score →What do users say about Agentic Soc Platform?
What people actually say about Agentic Soc Platform — is it worth it?
Our community sentiment research written Jul 31, 2026 is more than 90 days old, so it is being re-reviewed against current data and is not shown.
How we verified this
Every listed fact about Agentic Soc Platform— pricing, features, links, status — is re-read from the vendor's own pages by our verification pipeline and each change is logged with a date; the last pass ran on 25 Oct 2026. Pages mix model-assisted synthesis with human review; see how we verify.
Verification history
We have re-verified Agentic Soc Platform 9 times since . Each pass re-reads the vendor's own pages and re-checks every listed field against that evidence; passes where nothing had changed are marked as such.
- — changed description, summary, our verdict, who should skip it, features
- — changed switching out, switching in, features, our verdict, limitations, use cases, description, who should skip it, summary, setup time, pricing fit, hidden costs
- — changed who should skip it, description, who it suits, summary, our verdict, features
- — changed pricing page
- — changed SSL certificate
- — changed use cases, who it suits, description, our verdict, features, hidden costs, limitations, switching in, switching out, who should skip it, pricing fit, setup time, summary
Showing the 6 most recent of 9 verification passes.
Free to cite with attribution — this page re-verifies continuously.
How much does Agentic Soc Platform cost in 2026?
Agentic Soc Platform: Free to use. Pricing last verified 25 Oct 2026.
Where the pricing makes sense
The company stage and team size where Agentic Soc Platform's pricing actually pencils out — and where peers do it cheaper.
ASP is MIT-licensed and self-hosted, so there is no per-seat or per-alert fee to compare — the budget line is infrastructure plus the engineering hours to run and extend it. That makes it cheapest for a small SOC with strong Python skills and expensive for a lean team that would otherwise buy a managed SIEM/SOAR with support included.
Has Agentic Soc Platform's pricing changed?
No plan price for Agentic Soc Platform has moved since we began logging in Aug 2026; the pricing page is re-read on every verification pass.
Who should pick Agentic Soc Platform?
Pick Agentic Soc Platform if you are SOC analysts buried in alert volume who want an AI-drafted investigation report as a starting point, MSSPs that need open-source, on-premise SOC tooling without per-seat licensing, Security engineers fluent in Python and YAML who can adapt modules and write playbooks, Blue teams running Splunk or ELK that must keep security data inside their own network.
Look elsewhere if you are Teams wanting a fully managed cloud SIEM/SOAR with vendor support and SLAs, Analysts without scripting skills who expect a plug-and-play console, Shops with no appetite for running their own upgrades, backups, and authentication, Buyers who need a support contract and a named escalation path before deploying.
Skip it if Skip ASP if you need vendor-run infrastructure, pre-built ticketing or chat connectors, and a support contract rather than a Python-and-YAML project your own engineers keep running.
GeneratedReal-world workflow fit
Concrete scenarios for the personas Agentic Soc Platform actually fits — and what changes day-one when you adopt it.
Overnight the SIEM fires 300 alerts. ASP ingests them through the YAML-configured Splunk source, extracts IOCs, enriches entities with reputation, pulses, and asset context, and opens prioritized cases.
Outcome: You start the morning with a handful of cases carrying AI-drafted severity, confidence, verdicts, attack chains, and remediation guidance instead of a raw alert queue.
You add a custom alert source as a Python module, define its credentials as a protected secret Custom Variable, and wire an enrichment playbook that runs LLM analysis with a human approval gate.
Outcome: The new source feeds cases without API keys living in code, and every playbook run leaves a sanitized message stream and duration you can review in the audit log.
Two alerts turn out to describe the same intrusion. You link the cases as Duplicate of with a 500-character note, keeping the parent case as the investigative thread.
Outcome: The investigation stays traceable across linked cases while dashboard metrics and case counts stay unchanged, so client reporting is not skewed.
Use cases
- Automate triage of hundreds of daily SIEM alerts into prioritized cases.
- Generate investigation drafts with AI-driven severity, verdicts, and remediation steps.
- Orchestrate multi-tool enrichment playbooks with LLM analysis and human approval gates.
- Deploy Harness Agents that search logs, query threat intelligence, and manage cases via asp-cli.
- Build an organizational security knowledge base from closed incident learnings.
- Link related, duplicate, or parent cases to keep investigations traceable without changing dashboards.
- Expose typed configuration to custom modules and playbooks with managed Custom Variables.
- Health-check and upgrade a self-hosted deployment with the bundled doctor.sh, backup.sh, and upgrade.sh scripts.
Setup time & first value
How long it actually takes to get something useful out of Agentic Soc Platform — broken out by persona, not the marketing-page minute.
Budget a day for a Python-fluent engineer to stand up the Docker Compose stack with init.sh, run doctor.sh, and connect one SIEM source. First useful case triage lands in the first week. Tuning playbooks, enrichment sources, and the knowledge loop is a multi-week iteration against your own alert data and LLM configuration.
Switching to or from Agentic Soc Platform
How to bring data in from common predecessors and how to get it back out — written for the switcher, not the buyer.
- →From a manual Splunk or ELK triage workflow: point an ASP module at the existing index via YAML and start creating cases from alerts you already receive.
- →From a legacy SOAR: port hard-coded playbook logic into YAML playbooks plus Python modules, keeping human approval gates where the old flow had them.
- →From a spreadsheet or wiki runbook: seed the knowledge loop by closing early cases with notes and remediation steps so extraction has material to work with.
- ↗To a managed cloud SIEM/SOAR: export case records and investigation notes before the contract ends, since knowledge extraction output lives only in ASP.
- ↗To a commercial SOAR: expect to rebuild enrichment and playbook logic in the new tool's native format; ASP playbooks are YAML plus Python.
- ↗To another self-hosted stack: take a backup.sh snapshot first — there is no cross-platform data migration tool documented.
Integrations
Resources & guides
Tutorials & Learning
YouTube returned 6 videos for “Agentic Soc Platform”, and we withheld 6: 6 did not mention Agentic Soc Platform. We are showing none, because we could not prove any of them are about Agentic Soc Platform.
Official links
What are the best Agentic Soc Platform alternatives?
The closest alternatives to Agentic Soc Platform we list are Dropzone AI, Torq and Anvilogic. Ranked by direct product-type match, not category overlap.
| Alternative | Pricing | Starts at | Last verified |
|---|---|---|---|
| Dropzone AI | Paid | Pricing not published | — |
| Torq | Contact Sales | Custom pricing | — |
| Anvilogic | Freemium | Pricing not published | — |
Alternatives to Agentic Soc Platform
View all
Dropzone AI
Dropzone AI runs autonomous AI SOC agents that investigate security alerts end to end and show the evidence behind each verdict
Tools that pair well with Agentic Soc Platform
Common stack mates teams adopt alongside Agentic Soc Platform, with the specific reason each pairing earns its keep.
Dropzone AI
Dropzone AI runs autonomous AI SOC agents that investigate security alerts end to end and show the evidence behind each verdict
Torq
Agentic AI SOC platform that triages, investigates and responds to security alerts with agents that learn from every closed case.
Anvilogic
Agentic SecOps platform that runs AI agents across SOC onboarding, federated search, detection engineering, and investigation
Agentic Soc Platform vs its closest rival
Agentic Soc Platform's closest head-to-head is with Air Ai — If you're a defense organization needing to crush materiel release timelines and unify complex supply chains, Air AI is the purpose-built heavy lifter — backed by huge recent contracts and deep integration with military systems. If you're a SOC team drowning in alerts and want open-source, AI-augmented triage you can run on-prem with full data sovereignty, Agentic Soc Platform gives you a free, extensible foundation. Choose Air for readiness at scale; choose ASP for security operations automation with zero vendor lock-in. Verdict generated
Head-to-head comparisons
Agentic Soc Platform vs Air Ai
If you're a defense organization needing to crush materiel release timelines and unify complex supply chains, Air AI is the purpose-built heavy lifter — backed by huge recent contracts and deep integration with military systems. If you're a SOC team drowning in alerts and want open-source, AI-augmented triage you can run on-prem with full data sovereignty, Agentic Soc Platform gives you a free, extensible foundation. Choose Air for readiness at scale; choose ASP for security operations automation with zero vendor lock-in.
GeneratedAgentic Soc Platform vs Audioeye
Choose AudioEye if you need fast, enterprise-grade web accessibility compliance with legal support and easy CMS integrations. Pick Agentic SOC Platform if you run a SOC and want a free, customizable, on-premise platform that combines SIEM, SOAR, and knowledge management with AI-augmented investigations. They serve entirely different domains.
GeneratedAgentic Soc Platform vs Mostly Ai
Mostly AI and Agentic SOC Platform serve completely different domains: synthetic data generation versus security operations. Unless your need is exactly synthetic data for analytics, choose Agentic SOC Platform—it's free, open-source, and offers powerful AI-driven investigation workflows. Mostly AI is enterprise-focused, contact-priced, and requires infrastructure investment, making it only suitable for dedicated data teams with privacy mandates.
GeneratedAgentic Soc Platform vs Sublime Security
These aren't competitors — pick by the problem, not by comparison. If your pain is inbound email threats (BEC, VEC, credential and callback phishing) landing in Microsoft 365 or Google Workspace inboxes, Sublime Security is the product: agentic report triage, evidence-backed verdicts, and auto-authored Sublime Script rules, bought through a sales conversation. If your pain is SIEM alert volume in an on-prem Splunk or ELK estate and you have Python/YAML engineers, Agentic SOC Platform is free to license and gives you AI-drafted case reports — but you own upgrades, backups, auth, and the young 0.5.x release cadence. Budget-only shoppers comparing 'email security' to 'free' are comparing two different jobs.
GeneratedAgentic Soc Platform vs Push Security
Choose Push Security if your priority is stopping browser-based attacks (AiTM, ClickFix) and controlling AI tool usage across all browsers without an enterprise browser mandate. Choose Agentic SOC Platform if you need an open-source, on-premise SOC platform that augments analysts with AI-driven investigation drafts and playbooks, especially if you run Splunk/ELK and want full data control.
GeneratedFrequently asked questions
Categories
Used Agentic Soc Platform? Help shape our editorial sentiment research.