AiSOC is an open-source, self-hosted AI Security Operations Center that ingests security telemetry, normalizes it to a common activity projection (actor, action, resource, location, outcome), and processes it through a detection engine executing 2,534 of 7,015 rules (plus 76 sliding-window rules) with per-tenant tuning. Alerts are correlated into incidents and investigated by AI agents using a local llama3.2:3b-instruct-q4_K_M model (~2 GB) via an LLM gateway; every prompt, tool call (lake queries, graph traversals, enrichment), and verdict is recorded in an auditable Investigation Ledger and exportable as a signed OCSF 1.9.0 evidence bundle. Threat intelligence from the CISA KEV catalog triggers retro-hunts against the ClickHouse event lake without executing mutations. Response playbooks require three opt-in switches (deployment, tenant, playbook) and a durable human approval pause persisted in Postgres. Deployment profiles include core (16 services, ~8 GB RAM), full (22 services, ~12 GB), and demo; installation via `make up` generates 15 secrets, creates an admin, and validates with `make smoke` (10/10 stages). Connectors include 87 click-and-connect integrations and four cloud collectors (AWS CloudTrail/S3/SQS, GCP Pub/Sub, Azure Event Hubs, syslog/CEF) with resumable cursors. Migration tooling translates 1,734 of 2,005 Splunk rules (1,711 partial). Stability gates require PR-gated E2E tests with negative controls; capabilities like ingest-detect-correlate-alert, detection engine, correlation, REST API, AI triage, event lake, retro-hunts, 68-hunt YAML library, SCIM 2.0, white-labeling, metering, entity graph (Neo4j), governed response, playbooks, per-tenant tuning, scheduled connectors, and UEBA are marked Stable. Package distribution is Beta. Security defaults: no hosted LLMs, model runs locally, SAML/OIDC/SCIM/MFA, RBAC, DML-only DB roles, encrypted credentials, zero telemetry. MIT licensed, funded by Cyble.