ThreatBook Flocks
Open-source, locally deployed Agentic SecOps platform — 7 specialist agents, 150+ tools, autonomous from day one
Built for the agent-skills supply chain
Flocks operates as an autonomous digital SOC — not a co-pilot. Seven specialist agents work together to triage, investigate, respond, and close the loop without analyst hand-holding.
Multi-agent architecture
Main agent Rex plans and dispatches; six specialists handle threat intel, alert triage, forensics, device ops, workflow orchestration, and coding tasks.
Autonomous closed-loop
No prompts needed. Continuously monitors alerts, correlates events, executes response, and routes tickets — every alert reaches a verified outcome.
One-sentence device onboarding
Connect any mainstream security device via API using natural language. When no API exists, Rex simulates a human logging into the web portal.
Self-evolving capability
Generates new agents, skills, workflows, and tools from natural-language descriptions. Distils lessons from real ops, self-corrects on observed failures.
Cross-device correlation
Unifies query and retrieval across legacy and modern systems in one pass — cuts investigation time from minutes to seconds.
Open source + local deploy
GitHub-hosted, one-click on Windows / Mac / Ubuntu. Full code control, full API access — embed into existing scripts and in-house platforms.
Autonomous SOC loop — alert to closure
Flocks treats SOC operations as a closed loop. Every alert progresses through these stages without analyst intervention. Analysts review outcomes, not every decision.
Three ways to get it running
Self-host (open source)
Clone from GitHub. One-click launch on Windows / Mac / Ubuntu. Full code control, no vendor lock-in.
- No heavyweight platform deploy
- Live in seconds on a developer laptop
- Full API + open codebase
Cloud-managed tier
Token-metered managed service. Free 30-day trial includes 10 million tokens per day to validate the architecture against real alerts.
- 10M tokens / day free for 30 days
- Managed model + tooling updates
- Hosted in same-region as your data
API embed
Drop Flocks into your existing scripts, toolchains, SIEM, SOAR, or in-house security platform with a single instruction.
- REST API integration
- Python / Bash callable from scripts
- Co-exists with current stack
What it has found in the wild
APAC offices & coverage
Same-jurisdiction threat-intel for ASEAN and East Asian compliance frameworks.
Common questions
Is Flocks really free and open-source?
Yes — the codebase is on GitHub and you can self-host on Windows, Mac, or Ubuntu with no licence cost. The managed cloud tier is metered separately (10M tokens/day free for 30 days, paid thereafter). Self-host has no token meter — you bring your own model API keys.
How is Flocks different from Microsoft Security Copilot or CrowdStrike Charlotte AI?
Two structural differences: (1) Flocks is multi-agent — one Main Agent orchestrates six specialists in parallel, vs a single monolithic LLM assistant. (2) Flocks is closed-loop autonomous — alerts flow alert → response → ticket → closure without analyst prompts, vs co-pilot products that suggest next steps and wait for a human to act.
Which LLMs does Flocks use?
The vendor does not specify a fixed LLM provider. The open-source build allows you to bring your own — OpenAI, Anthropic, local Llama / Qwen / DeepSeek deployments are all supported via standard API contracts. Token-metering on the managed tier suggests it abstracts the underlying model.
What does "150+ integrated tools" actually mean?
A pre-built library of API integrations covering mainstream SIEM, EDR, firewalls, IDS, ticketing, threat intel feeds, and coding utilities (Python, Bash execution). Plus first-class support for adding custom tools via natural-language description — agents learn the new tool from a sentence.
Can Flocks operate devices that have no API?
Yes. Rex (the Main Agent) can simulate a human logging into a web portal to retrieve device data when an API isn't available. This covers legacy security appliances that pre-date the API era — particularly common in APAC enterprise environments with long device lifecycles.
How does the "self-evolving" feature work?
Agents, skills, workflows, and tools can be generated in natural language. The system distils lessons from real-world operations, self-corrects on observed failures, and builds SecOps capability tailored to your enterprise. In practice: a junior analyst describes a new playbook in English, Flocks runs it next time the matching alert pattern appears.
Why does ThreatBook's APAC presence matter for SOC tooling?
For enterprises in Singapore (MAS TRM), Hong Kong (HKMA cyber resilience), Tokyo, Seoul, Sydney, Mumbai, Jakarta running regulated SOC operations, having the vendor in-region simplifies vendor due-diligence, data-residency conversations, and incident-response coordination. Flocks self-hosted is also a clean fit for air-gapped or sovereign-cloud deployments common in APAC government and finance.
Does RECATOOLS get paid to list Flocks?
No. EX-AI-002 is a free editorial listing — no affiliate commission, no sponsorship. We list Flocks for the same reason we list SafeSkill (also ThreatBook): the AI-security category matters for our APAC audience, and Flocks is one of the few credible open-source autonomous SecOps platforms on the market. Any future monetised listing will be flagged Partner or Sponsored with explicit disclosure.
The full story
What is ThreatBook Flocks?
ThreatBook Flocks is a free, open-source, locally-deployed Agentic SecOps platform — a multi-agent system that runs SOC work autonomously. Where most "AI security" products are co-pilots that suggest next steps, Flocks is the analyst itself: it monitors alerts, queries devices, correlates findings across legacy and modern tools, files tickets, and closes the loop — without waiting to be prompted.
The pitch in the vendor's own words: "Your SOC needs a digital workforce, not another AI assistant."
The problem it tackles
Every SOC team in the world has the same four-headed problem:
- Alert overload — 80% of analyst time goes to triage, device queries, and chasing context
- Capability gaps — workflow orchestration needs senior expertise that doesn't scale
- Fragmented stacks — legacy and modern tools don't talk; investigations stay manual
- Knowledge loss — institutional know-how walks out the door with every role change
Flocks is built to absorb all four — by being the agent layer that operates across whatever stack you already own.
Architecture: 7 specialist agents
There's a Main Agent named Rex who plans and dispatches. Six specialist agents handle the actual work:
| Agent | Job |
|---|---|
| Threat Intel | Correlates indicators against ThreatBook's intelligence dataset |
| Alert Triage | First-pass classification + priority assignment |
| Forensics | Host compromise analysis, attack-chain reconstruction |
| Device Ops | Health checks, configuration polling, status summaries |
| Workflow | Orchestrates multi-step playbooks across tools |
| Coding | Writes and executes scripts (Python, Bash) for ad-hoc tasks |
Plus 150+ integrated cybersecurity and coding tools baked in. When an API doesn't exist for a device, Rex can simulate a human logging into the web portal to retrieve the data.
How an alert flows through Flocks
The datasheet describes the autonomy mode in concrete terms: "Doesn't wait for prompts. Continuously monitors alerts, tasks, and progress, correlating events across time zones and accumulating institutional knowledge. Fully autonomous closed loop from data ingestion and triage to investigation and response."
In other words: alert in → verdict + remediation + ticket → closed. No analyst hand-holding required.
Six worked scenarios from the datasheet
1. Closed-Loop Alert Response. Triage decisions sit unactioned across scattered tools. Flocks chains platforms together to execute response and ticket routing — every alert reaches a verified outcome, not just a verdict.
2. Cross-Device Correlated Investigation. Stop logging into five tools to answer one question. Flocks pulls and correlates data from legacy and modern devices in one pass — "cutting investigation time from minutes to seconds."
3. Security Device Health Checks. Manual inspection leaves failures undetected for days. Flocks polls device status on a schedule, summarises findings, fully automates routine device ops.
4. Host Compromise Forensics. Emergency triage, compromise analysis, and forensic collection in one workflow — reconstructing the full attack chain "at machine speed before lateral movement spreads."
5. Intelligent Device Integration. Use natural language to integrate mainstream security devices via API — "cutting integration cost dramatically" compared to traditional onboarding.
6. Build Your Own Agents. Modular composition + low-code customisation + self-learning — build proprietary agents tailored to your enterprise's workflow without rewriting your stack.
"Investigates and responds autonomously. Orchestrates workflows intelligently. Operates devices like a human. Self-evolves over time."
Self-evolving capability accumulation
The "self-evolving" angle isn't marketing fluff — it's a specific architectural choice. Agents, skills, workflows, and tools can be generated in natural language and refined over time:
- Distils lessons from real-world operations (every closed incident updates the institutional model)
- Self-corrects on observed failures
- Builds SecOps capability tailored to YOUR enterprise — not a generic "AI SOC analyst" baseline
The lowered barrier-to-entry is the whole point: a junior analyst can teach Flocks a new playbook by describing it in English. No DSL, no YAML schema, no SOAR sales call.
Three ways to deploy
| Mode | Use case |
|---|---|
| Self-host (open-source) | Clone from GitHub, one-click on Windows / Mac / Ubuntu, live in seconds — "no heavyweight platform deployment" |
| Cloud-managed tier | Token-metered. 10M tokens/day free for 30 days, paid plans thereafter |
| API / embed | "Embed Flocks into your existing scripts, toolchains, security devices, or in-house platforms with a single instruction" |
The unrestricted local-deploy + open-source codebase + API is the headline differentiator vs proprietary AI SOC products (SentinelOne Purple AI, Microsoft Security Copilot, CrowdStrike Charlotte AI) — Flocks runs on your hardware, you read the code, and you customise the agents.
Why APAC SOCs should care
ThreatBook's offices in Singapore, Hong Kong, China, and the UAE matter for regulated APAC enterprises in financial services, government, healthcare, and critical infrastructure. Same-region intelligence feeds + same-region engineering support + locally-deployed code = a vendor due-diligence story that maps cleanly onto MAS TRM (Singapore), HKMA cyber resilience (Hong Kong), RBI cybersecurity framework (India for ThreatBook's outreach), and PDPA frameworks across ASEAN.
The autonomy story also reads particularly well in the APAC labour market context: enterprise SOC teams in Singapore, Tokyo, Seoul, Sydney are perpetually short on senior analysts. Flocks is positioned as the work-multiplier rather than a hire-replacement, but the practical effect is the same — a small team can cover what would have needed a 24/7 staffed SOC of double the headcount.
Pricing
- Free + open source — GitHub clone, self-host on Windows/Mac/Ubuntu, full code control
- 10M free tokens/day for the first 30 days after onboarding the managed tier
- Enterprise — pricing on request via the ThreatBook Flocks product page
How it compares
| Flocks | SentinelOne Purple AI | MS Security Copilot | CrowdStrike Charlotte | Dropzone AI | |
|---|---|---|---|---|---|
| Open source | ✅ | ❌ | ❌ | ❌ | ❌ |
| Self-host | ✅ | ❌ (SaaS only) | ❌ | ❌ | ❌ |
| Multi-agent | ✅ (7 agents) | Single | Single | Single | Single |
| Closed-loop autonomous | ✅ | Co-pilot | Co-pilot | Co-pilot | Triage-focused |
| Custom agent authoring | ✅ (natural language) | Limited | Limited | Limited | No |
| APAC vendor | ✅ | US | US | US | US |
Verdict
If you (a) run a SOC, (b) are tired of co-pilots that suggest things rather than do them, and (c) want code-control over the agents touching your security stack, Flocks is one of the only platforms in 2026 that ticks all three. The open-source / self-host posture is unique among the AI-SOC category — every competing product is closed-source SaaS. For APAC enterprises specifically, having the vendor in the same time zone with same-jurisdiction support is the closer.
Visit the ThreatBook Flocks product page or read the official datasheet for the demo + token-trial signup.
Replace SOC busywork with autonomous agents
Try the open-source build on your laptop, or claim 10M free tokens/day on the managed tier for 30 days.
Try ThreatBook FlocksRelated News
You may be interested in these recent stories from our newsroom.
No related news yet for this tool. Our editorial team publishes new pieces every week.
Browse all news →