Open-Source AI Security Automation

Automate threat detection and response with AI-powered workflows.
Self-hosted. 80+ integrations. Built for modern SOC teams.

Why Allama • Features • Quick Start • Architecture

Security teams face 500+ alerts daily. Manual investigation is slow, inconsistent, and burns out analysts. Legacy SOAR tools cost $100k+ and require consultants to implement.

Allama changes this:

• 90% faster triage — AI agents enrich and prioritise alerts automatically
• Zero vendor lock-in — 100% open source, self-hosted on your infrastructure
• No coding required — Visual workflow builder for common automation
• Enterprise-ready — Multi-tenant, SSO, audit trails, and compliance controls

Build security playbooks with drag-and-drop. Conditional logic, parallel execution, and loops — no code required.

Deploy autonomous agents that understand threats, make decisions, and execute responses. Supports OpenAI, Anthropic, Azure, or self-hosted models via Ollama.

Connect your entire security stack:

Track incidents from detection to resolution. Custom fields, task assignment, file attachments, and complete audit trails.

Run custom Python in isolated WebAssembly sandboxes. Network isolation, resource limits, and full audit logging.

git clone https://github.com/digitranslab/allama.git
cd allama
make init
make dev

Or use the one-click demo script:

./demo.sh

Open http://localhost and start building workflows.

Requirements: Docker, Python 3.12+, 4GB RAM, 10GB disk space

flowchart LR
    subgraph Sources["Data Sources"]
        S1[SIEM Alerts]
        S2[EDR Events]
        S3[Cloud Logs]
        S4[Webhooks]
    end

    subgraph Platform["Allama Platform"]
        API[API Gateway<br/>FastAPI]
        WF[Workflow Engine<br/>Temporal]
        AI[AI Agents<br/>PydanticAI]
        INT[Integrations<br/>80+ Tools]
    end

    subgraph Actions["Automated Response"]
        A1[Enrich & Triage]
        A2[Contain Threats]
        A3[Create Cases]
        A4[Notify Teams]
    end

    S1 & S2 & S3 & S4 --> API
    API --> WF
    WF --> AI
    AI --> INT
    INT --> A1 & A2 & A3 & A4

SOC Teams — Reduce alert fatigue by 90%. Automate triage, enrichment, and containment.

MSSPs — Multi-tenant architecture. White-label deployment. API-first integration.

Cloud Security — Infrastructure as code. Terraform modules. Self-hosted for data sovereignty.

• Discord — Real-time support and discussion