OpenSOC: An Open-Source AI-Powered Cloud Security Operations Platform for Small and Medium Enterprises

Small and medium enterprises (SMEs) often operate with limited security staffing while managing endpoints, servers, network devices, and cloud services that generate large volumes of security events. Security information and event management (SIEM) platforms can centralize these events, but effective deployment also requires reliable collection, useful detection logic, investigation workflows, and actionable reporting. This paper proposes OpenSOC, an open-source, cloud-deployable Security Operations Center (SOC) platform intended for small environments. The design combines endpoint telemetry collection through Wazuh-compatible agents, event search and storage using OpenSearch and PostgreSQL, rule-based detection, a machine-learning anomaly-scoring component, incident management, role-based access control, and analyst-approved response actions. The proposed architecture emphasizes tenant separation, auditability, and a staged deployment that can be evaluated using controlled security scenarios. Since the project is being developed as a project-based learning system, this paper distinguishes the proposed design and evaluation plan from measured implementation results; quantitative performance claims are reserved for testing on the completed prototype.