H3AD-SEC · SOC OPERATIONS HUB

Structured Triage.
Every Shift.

Operational query tooling for authentication, network, endpoint, and cloud — built for L1-L2 analysts running structured triage in Microsoft Sentinel and Splunk. Named for what they find, not what they use.

4COVERAGE DOMAINS
Auth · Network
Endpoint · CloudDOMAINS
DailyTRIAGE
Sentinel · XDR
SplunkPLATFORMS

Automation isn't about replacing the analyst.
It's about removing the work that doesn't need one.

Coverage Areas 4 Domains
Query Format KQL · XQL · SPL
Use Case Daily Triage
Delivery Copy-Ready
TOOLS
QUICKTRACE
LIVE
"Daily queries. Zero ramp-up. Every shift."
Pre-built daily triage queries across auth, network, endpoint, and cloud — named for what they find, not what they use.
4 CATEGORIES · KQL / XQL / SPL · COPY-READY
LAUNCH QUICKTRACE →
SHIFTLOG
LIVE
SOC Shift Handover. Documented, formatted, handed off.
Structured shift handover tool for SOC analysts. Captures open cases, triage status, escalations, IOCs, and next-shift priorities, then generates a formatted plain-text handover report.
6 SECTIONS · HISTORY LOG · COPY + PRINT · ZERO BACKEND
LAUNCH SHIFTLOG →
PHISHOPS
LIVE
"Seven steps. Every phish. No missed checks."
Guided phishing investigation tracker for SOC analysts. Header analysis, URL triage, attachment sandbox, Okta impact assessment, containment, and closure — with a live IOC aggregator and markdown export.
7 STEPS · HEADER / URL / SANDBOX / IDENTITY / CONTAINMENT · IOC EXPORT
LAUNCH PHISHOPS →
— VISITORS