AegisSOC: An Adaptive AI-Powered Security Operations Center with Unsupervised Anomaly Detection and Retrieval-Grounded Alert Explanation

Small and mid-sized organisations, colleges among them, collect security logs from firewalls, Windows desktops, Linux servers and network devices, but rarely have the staff or the budget to watch them. Rule-based SIEM correlation only reports attacks that someone has already written a rule for, and loose rules flood analysts with alerts that are mostly harmless. This paper presents the design and Stage-I implementation of AegisSOC, an AI-assisted Security Operations Center built from open-source components. Logs from four sources are collected through Syslog, Winlogbeat and a Python forwarder, posted to a FastAPI backend, and normalised by a Pandas parser into one JSON schema stored in MongoDB. Features such as failed logins, distinct destination ports, outbound bytes and new process counts are computed over five-minute windows per host, user and source IP. Two unsupervised detectors trained only on normal activity, an Isolation Forest and a dense Autoencoder, score each window, and an alert is raised when either score passes a percentile threshold, with higher severity when both agree. Each alert is then explained by a Large Language Model whose prompt is restricted to MITRE ATT&CK, CVE and playbook passages retrieved from a vector store. Four backend agents classify and group alerts, check process indicators, suggest playbook steps and write PDF incident reports, and no response action runs without analyst approval. Design, literature review and about 40 percent of development are complete. Detection accuracy has not yet been measured; the evaluation protocol on CICIDS-2017, UNSW-NB15 and college lab logs is described in full so that Stage-II results can be checked against it.

Keywords - Security Operations Center, Anomaly Detection, Isolation Forest, Autoencoder, Retrieval-Augmented Generation, Large Language Models, Log Normalisation, Alert Fatigue