Vigil

Vigil is an open source AI security operations center released under the Apache 2.0 license. It runs a team of 13 specialized AI agents that triage alerts, investigate incidents, correlate signals and respond to threats, using more than 30 integrations built on the Model Context Protocol. The agents are coordinated through Bifrost, an open LLM gateway. It is local first, so data stays in the user's own environment, and workflows are plain text files that can be read, changed and shared. It targets security engineers, researchers and teams who want an agentic SOC they can inspect rather than a proprietary hosted service. The project describes five pillars. Threat detection draws on more than 7,200 community rules written for Sigma, Splunk, Elastic and KQL, with a triage agent scoring every alert. Vulnerability analysis uses investigator, correlator, threat intelligence, forensics, network and malware analyst agents to trace root cause. Agent red teaming runs hypothesis driven hunts mapped to MITRE ATT&CK. An auto response agent scores its own confidence and contains threats on its own above a configurable threshold, 0.90 by default, and routes lower confidence cases to a human reviewer. Actions such as WAF blocks, gateway blocks and session revokes are recorded in a full audit trail. The site also promotes a community with events and workshops. The software carries no license cost, and the site says a running SOC takes under three minutes to set up. No paid plans are listed.