How jimmybianco/soctoolkit works
SOC Toolkit is a static, client-side security-operations utility. Analysts enter one or more indicators; the browser identifies their types, builds matching lookup links, and opens selected sources. The single JavaScript file also supports defanging, configurable tools, preferences, and an RSS news reader. The README documents these capabilities, but the supplied source excerpts are partial, so internal calls between those subsystems are shown only where supported by the documented workflow.
Main entry points: app.js News feed reader · index.html Application page · style.css Interface styling
Components 15
Indicator lookup
- Indicator input
app.js - Type detection
app.js - Lookup links
app.js - Source catalog
app.js - Defang and normalize
app.js
Tools and preferences
- Custom tools
app.js - Config and theme
app.js - Local preferences
Security news
- News feed reader
app.js - Feed cache
app.js
Browser interface
- Application page
index.html - Interface styling
style.css
Other components
- SOC analyst
- OSINT services
- RSS publishers
Connections 16
- SOC analyst → Application page: uses
- Application page → Interface styling: styled by
- Application page → Indicator input: loads
- Indicator input → Type detection: submits indicators
- Type detection → Lookup links: selects types
- Source catalog → Lookup links: provides sources
- Lookup links → OSINT services: opens lookup links
- SOC analyst → Defang and normalize: requests conversion
- SOC analyst → Custom tools: customizes tools
- Custom tools → Local preferences: persists settings
- SOC analyst → Config and theme: exports or imports
- Config and theme → Local preferences: reads or writes
- SOC analyst → News feed reader: views news
- News feed reader → RSS publishers: fetches feeds
- News feed reader → Feed cache: stores and merges
- News feed reader → Local preferences: persists feed preferences