Incident timeline builder
Build a chronological incident timeline in UTC, then export it as Markdown, CSV, or JSON. Entries stay in your browser.
Small tools for SOC work
Utilities I find myself wanting during triage, write-ups, and SIEM planning. They run entirely in your browser: nothing you enter is uploaded or sent anywhere.
IOC defang and refang
Make URLs, domains, IP addresses, and email addresses safe to paste into reports and chat, or turn defanged indicators back into usable ones.
SHA-256 hash checker
Hash text or a file with SHA-256 and compare it with an expected value, without the file leaving your machine.
Syslog PRI decoder
Decode the <PRI> at the start of a syslog message into facility and severity, or work out the PRI for a facility and severity.
IPv4 subnet calculator
Network, broadcast, usable host range, mask, and wildcard for any IPv4 address and prefix, with special-range detection.
SIEM storage estimator
Rough storage needs from event rate, event size, retention, and your own compression and overhead assumptions.
Data transfer time estimator
How long a bulk copy will take at a given link speed and efficiency, for planning migrations and backups.
Estimators give arithmetic answers based on the assumptions you enter. They are planning aids, not vendor sizing tools. Validate against your own deployment.