AlphaSOC AE

AlphaSOC AE processes network telemetry to expose infected hosts, emerging threats, and targeted attacks in an environment. It examines activity for anomalies and security indicators, giving analysts a practical starting point for reviewing network behavior and investigating findings. The engine accepts VPC flow logs and DNS resolver logs from Amazon Web Services, Google Cloud Platform, and Microsoft Azure.

It also ingests telemetry from Corelight network sensors, Zeek, Suricata, Splunk, Snowflake, and Elastic, covering cloud services, network sensors, and data platforms. Detected anomalies and threats become alerts in JSON format, which SIEM and SOAR platforms can consume in subsequent security workflows. Notifications can go to Slack, PagerDuty, or email, while Amazon Web Services EventBridge and Google Cloud Platform Pub/Sub support routing and escalation.

Security teams and people responsible for network activity review can use it during threat hunting, alert investigation, and environment monitoring. Configuration is available through the web interface bundled with its snap package or through configuration files stored on disk. Published by AlphaSOC as freeware for Linux in the Security & Privacy category, it requires Linux with snapd and runs on amd64 architecture. The current version is 1.20261013.114.1.ba7993d8f, and AlphaSOC’s documentation covers the engine’s architecture, capabilities, API, and on-premise installation guidance.