Building the Foundation for Autonomous SecOps, Together
ZeroSOC is an open, community-driven framework standardizing how human analysts, deterministic automation, and AI agents collaborate on detection, investigation, and incident response.
An Open Working Draft for Practitioners
No single team or vendor has all the answers for agentic security operations. The current release is an open working draft (v0.x) designed to start structured, peer-reviewed conversations across the SecOps community. We invite you to read, critique, and co-develop the specifications.
Grounding Autonomous Operations
The ZeroSOC Framework defines an authoritative, mathematically precise operational plane without vendor lock-in.
Aspirational North Star, Pragmatic Reality
Autonomy is a continuum, not a binary switch. Real-world SecOps balances deterministic scripts for repetitive volume, AI agents for judgment under uncertainty, and human analysts for safety gates, ambiguous escalations, and accountability.
Executor Neutrality & Human Readability
"You can outsource thinking, but you cannot outsource understanding." Processes are independent of executor type—a human, script, or AI agent follows the exact same normative steps. Playbooks remain clean Markdown so humans retain full auditability and governance.
Closed-Loop Continuous Feedback
Triage false-positives and post-incident root cause analyses feed directly back into detection engineering baselines and playbook updates, systematically eliminating alert rot and maintaining high-fidelity signals.
The 4 Phases & 5 Measurement Gates
ZeroSOC anchors every operational metric to mathematically verifiable state transitions on OCSF v1.8 schema objects. Click any phase below to inspect its I/O contracts.
Triage & Investigation
Objective & Roles
Fast alert aggregation into Cases, domain-specific triage, and concurrent A/B hypothesis testing.
Inputs (Consumes)
- Alerts (OCSF 2004) aggregated into Cases (OCSF 2005)
- Enrichment sources (CMDB, Identity, Threat Intel)
- Standardized Playbooks (04-Playbooks)
Outputs (Produces)
- G2: Closed Case OR Promotion to Investigation
- G3: Confirmed Incident + Category (IC-##)
- Triage Note & Investigation Note
Open Source Repositories
The ZeroSOC initiative is split across focused open repositories hosted under the
github.com/ZeroSOC organization.
The authoritative body of knowledge defining taxonomy, playbooks (Triage & Investigation), deliverables schemas, and performance metrics in Markdown.
The reference open runtime harness and execution engine for autonomous SecOps agents, featuring local execution sandboxes and transparent audit logging.
Deterministic attack replay scenarios, synthetic telemetry generation, and benchmark evaluation suites for testing and scoring SecOps agent reasoning.
Model Context Protocol (MCP) servers and standardized tool definitions connecting AI agents safely to SIEM, EDR, Identity, and Cloud APIs.
How to Adopt ZeroSOC
ZeroSOC is designed to be adopted incrementally without ripping and replacing your current security stack.
Explore the Playbooks
Browse the Markdown catalogs in 04-Playbooks/ for domain triage, A/B hypothesis
investigation, and containment procedures.
Align to OCSF Schema
Map internal detection rules and alert findings to standardized OCSF classes
(Detection Finding [2004] and Incident Finding [2005]).
Deploy Executor-Neutral SOPs
Implement standardized playbooks across analyst runbooks, deterministic SOAR automations, and LLM agent prompts.
Framework Manifest →Measure with G1–G5 Gates
Track MTTA, MTTV, MTTC, and the false-positive surface across the five measurement gates to guide detection engineering.
Operational Metrics →Frequently Asked Questions
Addressing the hard questions and real skepticism regarding autonomous security operations.
No. Despite the name, we do not believe fully autonomous ("lights-out") SOCs are achievable or desirable today. ZeroSOC represents an aspirational north star to guide collective practitioner research and standardization.
In reality, mature SecOps is a hybrid continuum: deterministic automation for routine volume, AI agents for bounded hypothesis testing under uncertainty, and human analysts for safety gates, ambiguous escalations, and accountability.
Not at all. The framework is an open working draft (v0.x) created to initiate structured dialogue among detection engineers, incident responders, and automation architects.
No single vendor or team has all the answers for agentic SecOps. ZeroSOC provides an extensible baseline for the community to test, challenge, and co-develop through open RFCs on GitHub.
ZeroSOC does not replace existing standards—it operationalizes them.
While NIST CSF 2.0 / SP 800-61r3 provide lifecycle governance and MITRE ATT&CK catalogs techniques, ZeroSOC provides the missing operational glue: standardized, executor-neutral Markdown playbooks, OCSF v1.8 schema contracts, and auditable metrics that execute identically across human analysts, deterministic scripts, and AI agents.
Unconstrained autonomy is dangerous. That is why the framework mandates explicit Agentic Guardrails, JIT Scoping, and mandatory Human-in-the-Loop (HITL) approval gates.
ZeroSOC requires transparent ("glass-box") reasoning logs and Case-attributed actions so organizations can mathematically measure and strictly control their blast radius.
ZeroSOC enforces three strict contribution and grounding models (CONTRIBUTING.md):
- The Sigma Model: Strict YAML schema conformance and mandatory frontmatter.
- The OCSF Model: Telemetry normalization to OCSF v1.8 (Alert Types for detections
vs Incident Categories
IC-##for impact). - The MITRE ATT&CK Model: Evidence-based grounding in real-world observed adversary behaviors with public threat intelligence citations. All playbooks must pass manual tabletop walkthrough validation before promotion.
Contributions follow an open, issue-first workflow under Apache-2.0:
- Open an Issue First: Discuss the proposal on GitHub (zerosoc-framework/issues) to agree on scope.
- Author & Format: Write Markdown playbooks using designated templates.
- Verify via Tabletop: Ensure every step is actionable by a human analyst and cross-links resolve.
- DCO Sign-off: Sign off commits with the Developer Certificate of Origin
(
git commit -s), with no CLA required. - Open Governance: Clear progression from Contributor → Reviewer → Maintainer. The Project Sponsor serves solely as a Trademark Steward with no special technical veto over open decisions.