Free in-browser tools for SOC analysts and incident responders
SOCtoys is a free, browser-only toolkit for security operations, digital forensics and incident response (DFIR), and development. Every tool runs entirely in your browser — nothing you paste, open or drop is uploaded, so the toolkit is safe to use on sensitive logs, samples and evidence. There is no sign-up, no backend and no tracking, and the whole suite can be downloaded as a single offline HTML file.
The 150+ tools include a log query builder that turns one threat hunt into Splunk SPL, Microsoft KQL, Cortex XSIAM XQL, Elastic ES|QL, CrowdStrike LogScale, Google SecOps YARA-L, IBM QRadar AQL and Sigma; a command-line analyzer; an IOC extractor and triage; a payload decoder and deobfuscator; and a notepad. It also covers certificate, HTTP security header, CSP, cookie, JWT and email-authentication (SPF, DKIM, DMARC) checks; Windows event log, registry, EVTX, MFT, prefetch and LNK forensics; PCAP, DNS and URL analysis; CVE and CISA KEV lookups; regex, CIDR, subnet, base64, hash and timestamp utilities; and incident timeline, ATT&CK, attack-flow and threat-map visualizations, alongside 140+ ready-made incident-response playbooks.