Tools the team needed.

KQL investigation toolkit that ends the rebuild-from-scratch loop

20+ KQL hunt templates · 7 detection categories · Single-file HTML deploy

Offline SOC knowledge base that captures what lives in analysts' heads

500+ knowledge entries · 8 dispatch engines · 11 alert playbooks

Synthetic Sentinel environment for analysts to practice on real attack data

55 attack scenarios · 14 MITRE techniques · 6 tactic groups

Curated threat intel delivery from RSS feeds to Slack, automated daily

30-min poll cycle · 3-layer dedup engine · Severity-scored daily digest

Paste a PowerShell command, get a plain-English breakdown for triage

34 LOLBins cataloged · UTF-16LE Base64 decoder · 0 network calls

Generate structured Claude system prompts for SOC analyst workflows

8 SOC task templates · 2 editions (general + SOC) · Single-file HTML deploy

Client-facing incident post-mortem reports, generated from a structured schema

42 kill-chain stage blocks · ATT&CK coverage grid · Self-contained HTML output

Local-LLM writing assistant for daily home use, no cloud, no subscription

70B local LLM (Hermes 4) · 0 cloud calls · Single Podman container