beenuar/AiSOC

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

Python★ 6,363+446 that day#4 on trending

Analyzed November 2, 2026 at 517a08f (main) with jscpd v5 in 10.4s.

C69.3/100

Project health963,748 lines of code (L)

Duplication68

4.8% in python, tsx, typescript, go, sql, bash, hcl, powershell, javascript, docker, makefile

Dead code92

0.9%

Complexity55

43.8%

The score is jscpd's own --health model: markup, data and text left out, tests kept. The numbers below are the trending scan's.

4.9%duplicated code · 31,406 of 641,461 lines

1,140clones in code

2,108code files of 12,051 scanned

10.16%duplicated over all files · 7,834 clones

Most complex files

apps/web/src/lib/api.ts645 cx
scripts/check_tenant_query_predicates.py405 cx
services/agents/app/playbook/engine.py378 cx
scripts/check_required_check_substance.py370 cx
scripts/check_toolchain_pins.py366 cx
scripts/check_ci_install_parity.py365 cx
apps/web/src/components/settings/SettingsView.tsx359 cx
apps/web/src/components/cases/CaseWorkspace.tsx323 cx
scripts/check_gate_coverage.py305 cx
apps/web/src/components/connectors/AddConnectorModal.tsx290 cx

Dead code 0.86% unused · 208 findings

apps/web/src/components/copilot/InvestigationTimeline.tsxunused-file
plans/cyble-aisoc/platform/frontend/app.jsunused-file
apps/web/src/components/graph/RealtimeGraph.tsxunused-file
plans/cyble-aisoc/platform/backend/app/connectors/sdk/ts_bridge.pyunused-file
apps/web/public/sw.jsunused-file
services/connectors/app/connectors/_examples/hello_connector.pyunused-file
apps/web/src/components/landing/Features.tsxunused-file
services/api/app/services/compliance.pyunused-file
plugins/mttr-widget/plugin.pyunused-file
services/osquery-tls/app/api/v1/endpoints/extensions.pyunused-file

The code number leaves out tests, fixtures, docs, examples, data files, styles, translations and vendored code, and 8 generated files: apps/web/src/data/connectorCount.ts, apps/web/src/data/corpusStats.ts, packages/aisoc-action/src/_vendor/verdict/index.ts, packages/sdk-ts/src/index.ts, packages/types/src/generated/connector-types.ts, services/api/app/api/v1/endpoints/reports.py, services/api/app/models/report.py, services/api/migrations/019_board_reports.sql.

Largest clones in the code

249 lines in 13 placespython1,824 tokens

services/actions/app/_health.py:1–249services/agents/app/_health.py:1–249services/api/app/_health.py:1–249services/connectors/app/_health.py:1–249services/fusion/app/_health.py:1–249and 8 more

1"""
2Phase 2.6 — shared liveness + readiness probes for AiSOC FastAPI
3services.
4
5The "liveness vs readiness" distinction is the single most-missed
6detail in self-deployed Python services. The two checks answer
7DIFFERENT questions and k8s (and any sensible load balancer)
8treats the answers differently:
9
10  * ``/livez``  — "is this process still running?". Returns 200 if

First 10 of 249 lines.

409 lines in 9 placespython1,942 tokens

services/actions/app/security/tenant_scope.py:78–486services/agents/app/security/tenant_scope.py:78–486services/connectors/app/security/tenant_scope.py:78–486services/fusion/app/security/tenant_scope.py:78–486services/honeytokens/app/security/tenant_scope.py:78–486and 4 more

78logger = logging.getLogger("aisoc.tenant_scope")
79
80_TRUTHY = {"1", "true", "yes", "on"}
81
82#: Mirrors ``INSECURE_SECRET_KEY_DEFAULTS`` in services/api/app/core/config.py
83#: so a placeholder secret is treated as "unset" on this side too. Verifying a
84#: token signed with a well-known literal would authenticate anybody who read
85#: the repository.
86INSECURE_SECRET_DEFAULTS = frozenset(
87    {

First 10 of 409 lines.

1125 lines in 2 placespython6,669 tokens

packages/aisoc-benchmark/aisoc_benchmark/replay.py:1–1125services/api/app/_vendor/aisoc_benchmark/replay.py:1–1125

1"""Scoring for replay evaluation: the agent against a customer's own analysts.
2
3Gap-closure Phase 1.3.
4
5This extends the benchmark package rather than standing beside it. The
6hallucination machinery is :func:`aisoc_benchmark.metrics.is_checkable_indicator`
7and :func:`~aisoc_benchmark.metrics.extract_checkable_indicators`, unchanged, so
8an indicator counted here is one the synthetic-corpus grader would also have
9counted. A second grader would eventually disagree with the first about what
10"hallucinated" means, and the published numbers would stop being comparable

First 10 of 1125 lines.

7 more

211 lines in 6 placespython1,271 tokens
services/agents/app/core/cors.py:1–211 services/api/app/core/cors.py:1–211 services/connectors/app/security/cors.py:1–211 services/honeytokens/app/core/cors.py:1–211 services/purple-team/app/core/cors.py:1–211and 1 more
76 lines in 9 placespython665 tokens
services/actions/app/security/tenant_scope.py:1–76 services/agents/app/security/tenant_scope.py:1–76 services/connectors/app/security/tenant_scope.py:1–76 services/fusion/app/security/tenant_scope.py:1–76 services/honeytokens/app/security/tenant_scope.py:1–76and 4 more
976 lines in 2 placespython4,821 tokens
services/agents/app/nl_query/translator.py:1–976 services/api/app/_vendor/nl_query/translator.py:1–976
181 lines in 5 placespython1,167 tokens
services/agents/app/core/kafka_security.py:1–181 services/api/app/core/kafka_security.py:1–181 services/fusion/app/core/kafka_security.py:1–181 services/threatintel/app/core/kafka_security.py:1–181 services/ueba/app/core/kafka_security.py:1–181
711 lines in 2 placespython4,578 tokens
services/actions/app/services/autonomy_evidence_rules.py:1–711 services/api/app/_vendor/autonomy_evidence_rules.py:1–711
228 lines in 4 placespython1,473 tokens
services/honeytokens/app/_migrate.py:1–228 services/osquery-tls/app/_migrate.py:1–228 services/purple-team/app/_migrate.py:1–228 services/ueba/app/_migrate.py:1–228
1343 lines in 2 placespython4,387 tokens
services/actions/app/live_actions/capability_contracts.py:1–1343 services/api/app/_vendor/action_contracts/capability_contracts.py:1–1343

Largest clones over all files, tests and data included

13779 lines in 2 placesjsondata files39,613 tokens

services/api/app/data/detections/detection_ruleset.json:1–13779services/fusion/app/data/detection_ruleset.json:1–13779

1{
2  "count": 768,
3  "rules": [
4    {
5      "category": "application",
6      "id": "det-application-001",
7      "match_when": {
8        "request_uri_pattern_match_any": [
9          "UNION SELECT",
10          "OR '1'='1",

First 10 of 13779 lines.

13415 lines in 2 placesjsondata files37,478 tokens

apps/web/public/marketplace/curated.json:1–13415marketplace/curated.json:1–13415

1{
2  "$schema": "https://aisoc.example.com/schemas/curated/v1.json",
3  "version": "1.0.0",
4  "generated": "2026-11-02T01:47:38Z",
5  "stats": {
6    "considered": 2514,
7    "eligible": 2503,
8    "selected": 489,
9    "min_per_family": 25,
10    "min_total": 300,

First 10 of 13415 lines.

19 lines in 160 placesyamldata files158 tokens
detections/chronicle-imports/_quarantine/adfs-db-suspicious-named-pipe-connection.yaml:4–22 detections/chronicle-imports/_quarantine/adfs-dkm-key-access.yaml:4–22 detections/chronicle-imports/_quarantine/aws-account-leaving-or-removed-from-organization.yaml:4–22 detections/chronicle-imports/_quarantine/aws-api-call-outside-of-organization.yaml:4–22 detections/chronicle-imports/_quarantine/aws-cloudtrail-logging-tampered.yaml:4–22and 155 more
```
4severity: medium
5enabled: false
6tags:
7  mitre: []
8  categories:
9  - endpoint
10references: []
11logsource:
12  product: chronicle
13detection:
```
First 10 of 19 lines.
249 lines in 13 placespython1,824 tokens
services/actions/app/_health.py:1–249 services/agents/app/_health.py:1–249 services/api/app/_health.py:1–249 services/connectors/app/_health.py:1–249 services/fusion/app/_health.py:1–249and 8 more
368 lines in 9 placespythontests2,419 tokens
services/actions/tests/test_tenant_scope.py:1–368 services/agents/tests/test_tenant_scope.py:1–368 services/connectors/tests/test_tenant_scope.py:1–368 services/fusion/tests/test_tenant_scope.py:1–368 services/honeytokens/tests/test_tenant_scope.py:1–368and 4 more

By format, code only

Format	Files	Lines	Clones	Duplicated lines	Duplication
python	1,579	501,464	991	29,168	5.82%
tsx	277	75,110	82	1,116	1.49%
go	96	25,042	43	463	1.85%
typescript	122	30,097	22	638	2.12%
bash	20	5,273	2	21	0.4%
powershell	3	2,255	0	0	0%
javascript	8	1,931	0	0	0%
sql	3	289	0	0	0%

By format, all files

Format	Files	Lines	Clones	Duplicated lines	Duplication
yaml	7,579	404,355	4,892	63,531	15.71%
python	2,560	763,049	1,725	40,943	5.37%
json	283	118,094	594	47,799	40.48%
markdown	423	81,329	230	2,405	2.96%
tsx	364	93,404	216	2,684	2.87%
go	144	36,892	70	735	1.99%
typescript	189	39,505	45	893	2.26%
docker	22	1,477	24	835	56.53%
sql	148	15,526	11	157	1.01%
hcl	38	4,507	10	140	3.11%

Trending appearances

Day	Rank	Stars	Files	Lines	Clones	All files	Code	Health	Commit
Nov 2, 2026	#4	6,363 (+446)	12,051	1,579,126	7,834	10.16%	4.9%	C 69.3	`517a08f`

Want this for your own project? Install jscpd and run jscpd ., or measure it the way the baselines were measured.