Allama

Open-Source AI Security Automation

Automate threat detection and response with AI-powered workflows.
Self-hosted. 80+ integrations. Built for modern SOC teams.

Why Allama • Features • Quick Start • Architecture

Why Allama?

Security teams face 500+ alerts daily. Manual investigation is slow, inconsistent, and burns out analysts. Legacy SOAR tools cost $100k+ and require consultants to implement.

Allama changes this:

• 90% faster triage — AI agents enrich and prioritise alerts automatically
• Zero vendor lock-in — 100% open source, self-hosted on your infrastructure
• No coding required — Visual workflow builder for common automation
• Enterprise-ready — Multi-tenant, SSO, audit trails, and compliance controls

Features

Visual Workflow Builder

Build security playbooks with drag-and-drop. Conditional logic, parallel execution, and loops — no code required.

AI-Powered Agents

Deploy autonomous agents that understand threats, make decisions, and execute responses. Supports OpenAI, Anthropic, Azure, or self-hosted models via Ollama.

80+ Integrations

Connect your entire security stack:

Case Management

Track incidents from detection to resolution. Custom fields, task assignment, file attachments, and complete audit trails.

Secure Script Execution

Run custom Python in isolated WebAssembly sandboxes. Network isolation, resource limits, and full audit logging.

Quick Start

git clone https://github.com/digitranslab/allama.git
cd allama
make init
make dev

Or use the one-click demo script:

./demo.sh

Open http://localhost and start building workflows.

Requirements: Docker, Python 3.12+, 4GB RAM, 10GB disk space

Architecture

flowchart LR
    subgraph Sources["Data Sources"]
        S1[SIEM Alerts]
        S2[EDR Events]
        S3[Cloud Logs]
        S4[Webhooks]
    end

    subgraph Platform["Allama Platform"]
        API[API Gateway<br/>FastAPI]
        WF[Workflow Engine<br/>Temporal]
        AI[AI Agents<br/>PydanticAI]
        INT[Integrations<br/>80+ Tools]
    end

    subgraph Actions["Automated Response"]
        A1[Enrich & Triage]
        A2[Contain Threats]
        A3[Create Cases]
        A4[Notify Teams]
    end

    S1 & S2 & S3 & S4 --> API
    API --> WF
    WF --> AI
    AI --> INT
    INT --> A1 & A2 & A3 & A4