How kuray12/soc-tools-extention works
SOC·TOOLS is a Manifest V3 Chrome extension for IOC triage. Analysts enter one or many indicators in the popup, which identifies their type, gathers intelligence, and presents enrichment and pivot results; analysts can also launch enrichment from selected text or detected page indicators. The README documents MITRE mapping, geolocation, exports, notes, and false-positive tags. Source excerpts confirm popup fetching and storage, plus content-script highlighting and background message/context-menu handling; some feature wiring is documented but not visible in the sampled code.
Main entry points: popup.js Lookup Controller · content.js Page IOC Highlighter · background.js Background Worker · popup.html Popup UI
Components 24
IOC Triage
- Popup UI
popup.html - Lookup Controller
js/popup.js - IOC Detection
js/popup.js - Bulk Lookup
js/popup.js
Enrichment
- Source Fetchers
js/popup.js - VirusTotal
- AbuseIPDB
- Shodan
- AlienVault OTX
- URLScan.io
- Geo / Whois
js/popup.js - DNS / Pivot
js/popup.js - DNS Services
- HackerTarget
- MITRE Mapping
js/popup.js - Results View
js/popup.js
Analyst Tools
- Local Storage
- Notes & FP Tags
js/popup.js - CSV / JSON Export
js/popup.js
Extension Runtime
- Page IOC Highlighter
js/content.js - Background Worker
js/background.js
Other components
- SOC Analyst
- Web Page
- Chrome Context Menu
Connections 31
- SOC Analyst → Popup UI: enters IOCs
- Popup UI → Lookup Controller: submits lookup
- Lookup Controller → IOC Detection: detects type
- Lookup Controller → Source Fetchers: requests enrichment
- Lookup Controller → Bulk Lookup: runs batch
- Bulk Lookup → Source Fetchers: fetches each IOC
- Source Fetchers → VirusTotal: queries
- Source Fetchers → AbuseIPDB: queries
- Source Fetchers → Shodan: queries
- Source Fetchers → AlienVault OTX: queries
- Source Fetchers → URLScan.io: queries
- Lookup Controller → Geo / Whois: looks up location
- Lookup Controller → DNS / Pivot: loads pivots
- DNS / Pivot → DNS Services: queries records
- DNS / Pivot → HackerTarget: queries reverse IP
- Lookup Controller → MITRE Mapping: maps intel
- Lookup Controller → Results View: renders results
- SOC Analyst → Notes & FP Tags: manages annotations
- Notes & FP Tags → Local Storage: reads and writes
- Lookup Controller → Local Storage: loads API keys
- Lookup Controller → CSV / JSON Export: exports results
- SOC Analyst → Page IOC Highlighter: toggles highlight
- Web Page → Page IOC Highlighter: provides page text
- Page IOC Highlighter → Web Page: highlights IOCs
- Page IOC Highlighter → Background Worker: sends IOC message
- Page IOC Highlighter → Local Storage: stores pending IOC
- SOC Analyst → Chrome Context Menu: selects text
- Chrome Context Menu → Background Worker: dispatches selection
- Background Worker → Local Storage: stores pending IOC
- Background Worker → Popup UI: opens enrichment
- Background Worker → Page IOC Highlighter: forwards highlight toggle