# jimmybianco/soctoolkit architecture

> Architecture diagram of the GitHub repository jimmybianco/soctoolkit, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/jimmybianco/soctoolkit
- Repository: https://github.com/jimmybianco/soctoolkit

## Overview

SOC Toolkit is a static, client-side security-operations utility. Analysts enter one or more indicators; the browser identifies their types, builds matching lookup links, and opens selected sources. The single JavaScript file also supports defanging, configurable tools, preferences, and an RSS news reader. The README documents these capabilities, but the supplied source excerpts are partial, so internal calls between those subsystems are shown only where supported by the documented workflow.

Main entry points: [`app.js`](https://github.com/jimmybianco/soctoolkit/blob/main/app.js) (News feed reader), [`index.html`](https://github.com/jimmybianco/soctoolkit/blob/main/index.html) (Application page), [`style.css`](https://github.com/jimmybianco/soctoolkit/blob/main/style.css) (Interface styling)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_lookup["Indicator lookup"]
  node_lookup_input["Indicator input<br/>[app.js]"]
  node_detection["Type detection<br/>[app.js]"]
  node_link_builder["Lookup links<br/>[app.js]"]
  node_source_catalog["Source catalog<br/>[app.js]"]
  node_defang["Defang and normalize<br/>[app.js]"]
end

subgraph group_customize["Tools and preferences"]
  node_tool_settings["Custom tools<br/>[app.js]"]
  node_config["Config and theme<br/>[app.js]"]
  node_browser_store[("Local preferences")]
end

subgraph group_news["Security news"]
  node_news_reader["News feed reader<br/>[app.js]"]
  node_feed_cache[("Feed cache<br/>[app.js]")]
end

subgraph group_presentation["Browser interface"]
  node_page["Application page<br/>[index.html]"]
  node_styles["Interface styling<br/>[style.css]"]
end

node_analyst(("SOC analyst"))
node_external_tools(("OSINT services"))
node_rss_sources(("RSS publishers"))

node_analyst -->|"uses"| node_page
node_page -->|"styled by"| node_styles
node_page -->|"loads"| node_lookup_input
node_lookup_input -->|"submits indicators"| node_detection
node_detection -->|"selects types"| node_link_builder
node_source_catalog -->|"provides sources"| node_link_builder
node_link_builder -->|"opens lookup links"| node_external_tools
node_analyst -->|"requests conversion"| node_defang
node_analyst -->|"customizes tools"| node_tool_settings
node_tool_settings -->|"persists settings"| node_browser_store
node_analyst -->|"exports or imports"| node_config
node_config -->|"reads or writes"| node_browser_store
node_analyst -->|"views news"| node_news_reader
node_news_reader -->|"fetches feeds"| node_rss_sources
node_news_reader -->|"stores and merges"| node_feed_cache
node_news_reader -->|"persists feed preferences"| node_browser_store

click node_page "https://github.com/jimmybianco/soctoolkit/blob/main/index.html"
click node_styles "https://github.com/jimmybianco/soctoolkit/blob/main/style.css"
click node_lookup_input "https://github.com/jimmybianco/soctoolkit/blob/main/app.js"
click node_detection "https://github.com/jimmybianco/soctoolkit/blob/main/app.js"
click node_link_builder "https://github.com/jimmybianco/soctoolkit/blob/main/app.js"
click node_source_catalog "https://github.com/jimmybianco/soctoolkit/blob/main/app.js"
click node_defang "https://github.com/jimmybianco/soctoolkit/blob/main/app.js"
click node_tool_settings "https://github.com/jimmybianco/soctoolkit/blob/main/app.js"
click node_config "https://github.com/jimmybianco/soctoolkit/blob/main/app.js"
click node_news_reader "https://github.com/jimmybianco/soctoolkit/blob/main/app.js"
click node_feed_cache "https://github.com/jimmybianco/soctoolkit/blob/main/app.js"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_lookup_input,node_detection,node_link_builder,node_source_catalog,node_defang toneBlue
class node_tool_settings,node_config,node_browser_store toneAmber
class node_news_reader,node_feed_cache toneMint
class node_page,node_styles toneRose
class node_analyst,node_external_tools,node_rss_sources toneIndigo
```

## Components

### Indicator lookup

- [Indicator input](https://github.com/jimmybianco/soctoolkit/blob/main/app.js): `app.js`
- [Type detection](https://github.com/jimmybianco/soctoolkit/blob/main/app.js): `app.js`
- [Lookup links](https://github.com/jimmybianco/soctoolkit/blob/main/app.js): `app.js`
- [Source catalog](https://github.com/jimmybianco/soctoolkit/blob/main/app.js): `app.js`
- [Defang and normalize](https://github.com/jimmybianco/soctoolkit/blob/main/app.js): `app.js`

### Tools and preferences

- [Custom tools](https://github.com/jimmybianco/soctoolkit/blob/main/app.js): `app.js`
- [Config and theme](https://github.com/jimmybianco/soctoolkit/blob/main/app.js): `app.js`
- **Local preferences**

### Security news

- [News feed reader](https://github.com/jimmybianco/soctoolkit/blob/main/app.js): `app.js`
- [Feed cache](https://github.com/jimmybianco/soctoolkit/blob/main/app.js): `app.js`

### Browser interface

- [Application page](https://github.com/jimmybianco/soctoolkit/blob/main/index.html): `index.html`
- [Interface styling](https://github.com/jimmybianco/soctoolkit/blob/main/style.css): `style.css`

### Other components

- **SOC analyst**
- **OSINT services**
- **RSS publishers**

## Connections

- SOC analyst → Application page: uses
- Application page → Interface styling: styled by
- Application page → Indicator input: loads
- Indicator input → Type detection: submits indicators
- Type detection → Lookup links: selects types
- Source catalog → Lookup links: provides sources
- Lookup links → OSINT services: opens lookup links
- SOC analyst → Defang and normalize: requests conversion
- SOC analyst → Custom tools: customizes tools
- Custom tools → Local preferences: persists settings
- SOC analyst → Config and theme: exports or imports
- Config and theme → Local preferences: reads or writes
- SOC analyst → News feed reader: views news
- News feed reader → RSS publishers: fetches feeds
- News feed reader → Feed cache: stores and merges
- News feed reader → Local preferences: persists feed preferences