Cyber Security Tools for Analysts

Pull indicators of compromise out of any block of text, log or report.

Neutralise indicators so they can be shared without becoming clickable.

Restore defanged indicators to their original, machine-readable form.

Collapse a messy indicator list down to its unique entries.

Standardise a mixed indicator list into one consistent format.

Review a set of pasted HTTP response headers against current guidance.

Break a Content-Security-Policy into its directives and flag the weak ones.

Check a set of CORS response headers for the combinations that undo them.

Read a STIX 2.1 bundle as structured objects instead of raw JSON.

Check a STIX 2.1 bundle for structural and required-property errors.

Trace the relationship graph inside a STIX bundle object by object.

Break a YARA rule into its meta, strings and condition sections.

Reformat a YARA rule to consistent indentation and section order.

Read a Sigma detection rule as structured logsource and detection blocks.

Reorder a Sigma rule’s top-level keys to the conventional sequence.

Find a MITRE ATT&CK technique by ID or name from a bundled dataset.

Narrow an unlabelled hash down to the algorithms that could have produced it.

Build or decode a CVSS v3.1 vector and see which metric drives the score.

Read a User-Agent string, with the token behind every claim and the spoofing tells named.

Paste a script or stylesheet, get its sha256/sha384/sha512 integrity attribute.

Build a Content-Security-Policy header directive by directive, not by editing a string.

Turn on, off or origin-scope a browser feature per directive, then copy the header.

Paste a PEM certificate to read its subject, issuer, validity, key and extensions.

Paste a PKCS#10 CSR to read its requested subject, key and Subject Alternative Names.

Paste a PEM certificate, get its SHA-1 and SHA-256 fingerprint.

Paste an OpenSSH public key line to read its type, size and SHA256 fingerprint.

Scan pasted text or code for the shape of a leaked API key, token or private key.

A charset-and-length entropy estimate, with the math and its limits shown, not a bare score.