← Projects

SOC Utils

A full self-hosted web toolkit built around the day-to-day reality of running a SOC shift — checking indicators, handing over to the next analyst, tracking client health, and writing the reports that prove any of it happened — instead of another spreadsheet nobody trusts.

Overview

SOC shift work involves a lot of moving parts: who’s covering which client this shift, what happened on the last handover, whether a given IP has been seen before, and whether last month’s health-check report actually got written up.

SOC Utils brings all of it into one place — a single self-hosted Django app covering the workflows an analyst actually touches during a shift, end to end.

Highlights

  • Threat intel in one pass — check an IP, domain, or file hash against VirusTotal and AbuseIPDB together, with relations, recent abuse reports, and a detection-ratio chart, instead of tab-switching between two sites. Includes a bulk mode that pages through a whole list as a background job so you can keep working while it runs.
  • Shift roster and client assignment — a monthly shift grid with bulk editing and keyboard shortcuts, plus a drag-and-drop board for who owns which client on the live shift, with a full audit trail of every reassignment (because “who had this client at 3am” is always a real question eventually).
  • Shift handover that isn’t a Word doc — per-client rich-text notes with configurable expiry, alert-handling stats logged per analyst per shift, and a live Healthy / To Monitor / Degraded status per client that carries forward with full history.
  • An email drafter with a conscience — a block-based composer for SOC incident emails (severity banners, key/value pairs, tables) with reusable templates per customer, paired with a Customer DLP check that flags if a different customer’s name accidentally ends up in the draft before it goes out.
  • Reports that generate themselves — shift handover, health check, and alert-stats reports (server-rendered charts included) come out the other end as PDFs, with bulk date-range export.
  • Automated Postgres backups — a sidecar container running a daily pg_dump with retention pruning, because a toolkit that manages its own data should not be the thing that loses it.

Stack

Django (hand-built admin, no DRF or django.contrib.admin), PostgreSQL 16, Redis 7 for sessions/caching, plain JavaScript on the frontend with no build step, matplotlib for server-rendered charts, and Docker Compose as the only supported way to run it — there’s no “just run it on the host” path, on purpose.