Analyst toolkit
Tools for the work between the alert and the answer
Paste anything and we will find the tools that fit. Decode it, look it up, line up the timeline, weigh the explanations, and tune the rule that keeps firing.
Runs only in your browser. What you paste or load here is never uploaded, saved, or sent anywhere. This page cannot make network requests at all, and it uses no cookies or storage. Reloading or closing the tab clears everything.
Paste anything
An IP address, domain, URL, email, hash, MAC address, AS number, timestamp, encoded text, or a block of notes. We work out what it is and list every tool that can handle it. Nothing is looked up until you open a tool.
That does not look like something I recognize. Try the decoder or the indicator extractor.
Analyze and decode offline, nothing leaves your browser
Rule tuner
Paste an alert, its rule and sample logs. Get narrow exclusion suggestions in YARA-L, Sigma, Splunk, Kusto or regex, with guardrails.
FeaturedHighlight tuner
Paste the alerting log and the false-positive log, highlight what to tune out, and have the page challenge it before it writes a Chronicle exclusion.
FeaturedSnort/Suricata tuner
Load the false-positive and true-positive captures, paste the rule and alert, and get offset, depth, distance, within and buffer recommendations checked against your traffic.
FeaturedDecoder
Base64, hex, URL, escapes, charcodes, XOR and compressed data. Peels layers automatically and inspects bytes.
Indicators
Defang and refang links and addresses, and pull every indicator out of a block of text.
Timestamps
Convert Unix, Windows FILETIME, WebKit and more. Handle log formats and time zones, and find the gap between two events.
IP and CIDR
Subnet math, range checks, private versus public, IPv6 helpers, range to CIDR.
Hashes and files
Identify a hash, hash text or a file locally, and check whether a file's contents match its extension.
MAC vendor
Who made a network card, from the IEEE list built into the site. Spots randomized private addresses.
Free email check
Is this a free, disposable or internet-provider mail domain? Optionally see who hosts the mail.
Hypothesis worksheet
Weigh competing explanations against the evidence so you do not lock onto the first idea.
Phishing triage
Walk through the signals, get a rough read and next steps, and copy a ticket note.
Incident note
Fill in a short form and get a clean Markdown note with defanged indicators.
Reference
Windows, Sysmon and PowerShell event IDs, logon types, programs to watch, estimative language.
Look things up your browser asks public sources directly
DNS records
A, AAAA, MX, NS, TXT, SOA, CAA, DNSKEY and more from a public resolver.
Looks up onlineDNS report
Name servers, SPF, DMARC, MTA-STS, CAA and DNSSEC with plain-language findings.
Looks up onlineDNSSEC test
Does the chain of trust validate? Keys, algorithms and signature expiry.
Looks up onlineDNS propagation
Compare the answers of five public resolvers to see whether a change has spread.
Looks up onlineReverse DNS
PTR records for addresses, and whether each name points back (forward-confirmed).
Looks up onlineWHOIS (RDAP)
Registration, age, expiry, registrar and name servers for a domain, IP or AS number.
Looks up onlineAbuse contacts
Who to report a domain or IP to: the registrar and the network owner.
Looks up onlineASN and routing
Which network announces an address or owns an AS number, and what it announces.
Looks up onlineLooking for reputation checks, the port reference, or the email checker? Those are in the Security Tool Stack and the Email Checker. Reputation sources such as VirusTotal and AbuseIPDB do not allow requests from web pages, so they stay as links there.