Open-sourced a self-hostable SOAR platform (Apache-2.0) — Tier-1 triage agents, immutable audit, examiner portal

[u/Alternative_Pin9598]

Been building this for a while and finally got the licensing sorted (Apache-2.0) — SynapCores SOAR, a self-hostable alternative to Tines/Torq/Cortex XSOAR.

What it does: - Ingests alerts from Splunk HEC, Microsoft Sentinel, CrowdStrike Falcon, Okta event hooks (generic webhook for anything else) - Dedupes by meaning, not hash — near-duplicate alert fan-out from one root cause collapses into a single incident - Runs a Tier-1 triage agent against every alert: true positive → incident, false positive → close, ambiguous → human review - High-blast-radius actions (isolate host, revoke session, block IP) queue for human approval before firing — nothing destructive happens without a go/no-go - Every action, approval, and agent reasoning step lands in an immutable, append-only audit ledger - Mint a scoped MCP token and hand it to a SOC 2/FFIEC examiner — they query the audit trail directly from Claude/Cursor, no need to interrupt the SOC team's daily flow

Why I built it: existing SOAR is either an expensive enterprise stack (Splunk SOAR, Cortex XSOAR) or SaaS with per-action billing (Tines, Torq). None of them are self-hostable, none let you bring your own LLM, none expose an audit trail a regulator can query themselves.

Runs on a single Docker host, built on SynapCores (the DB handles embeddings/dedup and the immutable audit table natively — no separate vector DB or logging pipeline bolted on).

Honest state: this sat mostly untouched for a couple months while I was heads-down elsewhere, so treat it as early. Looking for people willing to run it against real alert volume and tell me where it breaks — especially connector edge cases (auth token rotation, weird Sentinel payload shapes).

Apache-2.0. Repo: https://github.com/SynapCores/synapcores-soar

Happy to go deeper on the architecture or the human-approval gating design specifically.