Itsoc MCP server

itsoc. — Local-first AI-assisted security operations

A local-first SOC workspace for turning raw logs into explainable, assignable work. The deterministic detector owns every severity verdict; the AI copilot reasons over the evidence, explains the dashboard, recommends next steps, and drafts work without changing a verdict or executing an action. The default deployment keeps logs on your machine.

Design principle — honesty by construction. Every number shown is derived from real data

or reported as n/a. Severity comes only from the rules. MITRE tags are *derived context, not

a verdict*. Unrecognized log formats are reported as "unparsed", never a false all-clear.

What it does

error-burst, suspicious-port, disk pressure) over a wide range of formats: canonical timestamp LEVEL host msg, RFC 3164 syslog, ISO-8601 journald/rsyslog, RFC 5424, JSON-line, auth CSV (timestamp,ip,username,status), ManageEngine Log360 (CSV + forwarded syslog), Android logcat, Windows EVTX, Loghub envelopes, and more via the universal format layer.

• Log anomaly detection — deterministic rules (brute-force, failure→success compromise,

evidence, rule predicate, and timeline. Advisory only.

• Plain-language explanations — the local model narrates each rule-caught finding with its

assets/users, a Cases board and case file (activity, observables, real attachments, eligible runbooks → pending approval only), generated/exported reports, offline STIX plus optional OEM IP lookup (ITSOC_OEM=1), and honest metrics.

• SOC subsystems — correlated incidents with a six-state analyst lifecycle, observed

surfaces dropped/lagging counts honestly.

• Live ingestion — a UDP syslog collector streams real events into a persistent store and

dashboard cards, incident ownership, and a bounded kanban board for cases.

• Analyst workspace — guided tour, focused copilot with separate reasoning, responsive

triage and IP containment. Templates create a plan; a human still approves execution.

• Response workflows — reusable, approval-gated runbooks for investigations such as phishing

returned by an authorised connector; unavailable streams are shown as unavailable, never as fake live data.

• Live log analysis — collector status and optional Splunk polling surface only events actually

lookups and vendor (OEM) API connectors, all with user-supplied, write-only credentials.

• Enrichment & connectors — offline MITRE ATT&CK mapping; optional threat-intel provider

clients (Claude Desktop / Claude Code); it computes no verdicts. Tools that only read (listruns, getfindings, getevidence, exportrun, threatintellookup) are annotated readOnlyHint: true. analyzelog, explainfinding, and proposeblockip are additive writes (not destructive) and never approve or execute a response action.

• MCP server (itsoc-icp) — a Model Context Protocol server exposes the analysis to MCP

Active-scanning modules (opt-in, use with authorization)

The Discovery and Vulnerabilities modules run real nmap scans (host discovery + NSE vuln scripts) against private/loopback targets you own. These are active network operations, not read-only — every scan is user-initiated, public targets are refused, and results are stored verbatim with source-reported severity.

Quick start

Requirements: Python 3.9+, and Ollama for local explanations.

# 1. (once) pull the local model
ollama pull qwen3:8b

# 2. run the console
python3 console/serve.py
# -> opens the SOC dashboard at http://127.0.0.1:8765/

Shortened. The full README is on GitHub.