AlphaSOC AE

AlphaSOC AE is a free software product for Linux in the Security & Privacy category. It processes network telemetry to help identify infected hosts, emerging threats, and targeted attacks within an environment. It is suited to people responsible for reviewing network activity and investigating security findings.

The engine accepts data from multiple network sources and formats. Supported inputs include VPC flow logs and DNS resolver logs from Amazon Web Services, Google Cloud Platform, and Microsoft Azure. It can also receive data from Corelight network sensors, Zeek, Suricata, Splunk, Snowflake, and Elastic. This range allows AlphaSOC AE to work with telemetry collected by cloud services, network sensors, and data platforms.

After processing the telemetry, AlphaSOC AE highlights anomalies and threats and makes alerts available in JSON format. Those alerts can be used by SIEM or SOAR platforms for further security workflows. Alerts can also be sent to Slack, PagerDuty, or email, with Amazon Web Services EventBridge and Google Cloud Platform Pub/Sub available for routing and escalation.

AlphaSOC AE can be configured through the web interface included with its snap package or by editing configuration files on disk. Its architecture, capabilities, API details, and on-premise installation guidance are documented at docs.alphasoc.com. MirrorNest links directly to the official AlphaSOC AE release instead of hosting a mirrored copy, so the catalog serves as an access point for the Linux download while preserving the original distribution source.