SOC Analyst Toolkit
SOC analysts spend their shifts triaging alerts, decoding suspicious payloads, correlating timestamps, and extracting indicators of compromise from logs. Speed matters — every minute spent on a manual decoding task is a minute an attacker has to move laterally. These free, browser-based tools accelerate the repetitive investigative work that fills your day.
Base64 Encoder / Decoder
Malware payloads, phishing emails, and PowerShell commands are frequently Base64-encoded to evade detection. Decode them instantly to reveal the actual command or URL. Essential for analyzing email attachments and obfuscated scripts.
URL Encoder / Decoder
Decode percent-encoded URLs from proxy logs and phishing emails. Reveal the actual destination behind obfuscated redirect chains used in credential-harvesting campaigns.
RegExp Tester
Build and test regex patterns for SIEM detection rules, log parsers, and IOC extraction. Live highlighting ensures your Splunk or Elastic query captures exactly the patterns you need.
IP Address Lookup
Look up source IP addresses from alerts to identify geographic location, ASN, and hosting provider. Quickly determine if traffic originates from a known VPN, cloud provider, or suspicious region.
Timestamp Converter
Convert Unix epoch timestamps from SIEM events, firewall logs, and API responses to human-readable dates. Correlate events across systems that use different time formats and time zones.
MD5 / Hash Generator
Generate file hashes to check against threat intelligence feeds, VirusTotal, or your organization's IOC database. Supports MD5, SHA-1, SHA-256, and SHA-512 — the standard formats used in CTI sharing.
Hex Converter
Convert hex-encoded payloads from packet captures and malware samples to readable ASCII. Decode obfuscated strings found in network traffic and memory dumps.
JSON Formatter & Validator
Pretty-print JSON logs from cloud services, API responses from threat intelligence platforms, and SIEM query results. The formatted view reveals nested structure that raw output hides.
Unicode Converter
Decode Unicode-encoded strings found in phishing emails, obfuscated JavaScript, and log entries. Attackers use Unicode encoding to bypass content filters and disguise malicious URLs.
User-Agent Parser
Parse user-agent strings from web proxy logs to identify unusual clients, automated scanners, or spoofed browsers. Helps distinguish legitimate traffic from reconnaissance activity.
Code Diff Tool
Compare two versions of a configuration file, detection rule, or script to identify changes. Useful during incident investigation when you need to determine what was modified on a compromised system.
Duplicate Line Remover
Deduplicate IOC lists, IP address collections, or log extracts before importing them into your SIEM or threat intelligence platform. Cleaner inputs mean faster processing.