H3AD-SEC Reference
A full usage guide for every module and tool across the H3AD-SEC platform. Start with the quick-start flows or jump directly to any tool reference below.
Getting Started
Platform Overview
H3AD-SEC is a browser-based operational cyber defense platform built by a SOC analyst for day-to-day detection, investigation, and hunting work. Every tool runs client-side — nothing is stored server-side unless explicitly noted (DNSCOPE uses a managed Vercel backend for DNS lookups).
The platform is organized into seven modules, each covering a distinct SOC workflow. Most tools take raw text or a single artifact as input and return enriched, structured output.
Use Case Flows
These are the most common investigation patterns across the platform. Each flow chains multiple tools in order.
Quick Reference
| I want to... | Use this tool | Input |
|---|---|---|
| Enrich a suspicious IP, domain, URL, or hash | X-VERDIKT | IP, domain, URL, or hash |
| Extract all IOCs from a paste/log/email | PARSE-X | Raw text |
| Map a domain's infrastructure | DNSCOPE | Domain or IP |
| Analyze email headers for spoofing | MAILSCOPE | Raw email headers |
| Generate an incident runbook fast | INSIGHT-AI | Alert name + context |
| Build a KQL / Sigma / SPL query from description | QUERYCRAFT-AI | Plain English description |
| Understand why an alert is a false positive | FPLENS-AI | Alert name + FP context |
| Map behaviors to MITRE ATT&CK | ATTMAP-AI | Threat description or IOCs |
| Reconstruct an attack timeline | CHRONO-AI | Event sequence |
| Get a malware behavior brief | MALBRIEF-AI | Malware name or description |
| Find AI prompts for SOC tasks | PROMPTVAULT | Browse by category |
| Browse or copy detection queries | TRACERULES | Browse by tactic/technique |
| Create or track a hunt hypothesis | HYPOS | Hypothesis entry |
| Visualize IOC pivot relationships | PIVEX | Nodes and edges |
| Find CVE or campaign-tied hunting queries | TRACEPULSE | CVE ID or campaign name |
| Run daily triage baseline queries | QUICKTRACE | Browse by category |
| Track a phishing investigation step-by-step | PHISHOPS | Phishing alert details |
| Write a shift handover report | SHIFTLOG | Shift notes and incidents |
| Analyze Windows registry for persistence | REGSCOPE | Registry key paths |
| Follow phishing IR procedure | PHISHBOOK | Navigate 9 phases |
H3AD-X
Multi-type IOC enrichment across 11 threat intelligence sources. Accepts IP, domain, URL, and hash — each scored against sources matched to the IOC type.
Client-side artifact extractor. Paste any unstructured text and it pulls out 18 IOC types automatically.
Domain and IP infrastructure mapper. Resolves eight data layers to build a complete picture of a target's network presence.
Email header analyzer. Parses raw headers to check authentication status, trace the full hop chain, and flag spoofing indicators.
H3AD-AI
API key required. All H3AD-AI tools call the Gemini API from your browser. Your key is stored in localStorage and never sent to any H3AD-SEC server. Get a free key at aistudio.google.com and paste it into the settings panel on any H3AD-AI tool.
AI runbook generator with an L3/SME analyst persona. Produces structured, investigation-ready runbooks from an alert name and context.
Detection query builder. Describe a threat behavior in plain English and get a ready-to-deploy query in KQL, Sigma, or SPL.
False positive analyzer. Given an alert and context, it scores FP likelihood and suggests tuning approaches.
ATT&CK technique mapper. Takes any threat description or IOC context and maps it to specific MITRE technique and sub-technique IDs.
Attack timeline builder. Takes a sequence of observed events and reconstructs them into a staged, labeled incident timeline.
Malware behavior analyzer. Generates a structured behavior brief from a malware name, hash, or behavioral description.
Curated AI prompt library for SOC analysts. Browse ready-to-use prompts organized by security discipline.
H3AD-DETECT
Browseable detection rule library across KQL (Microsoft Sentinel), Sigma (generic), and XQL (Cortex XDR) formats. Rules are fed from the QUERYVAULT data repo.
H3AD-HUNT
Threat hunting hypothesis platform. Browse a curated hypothesis library or create your own, with ATT&CK tagging, data source requirements, and priority scoring.
Force-directed IOC pivot graph. Visualize relationships between IPs, domains, hashes, and infrastructure nodes using an interactive graph.
CVE and campaign-tied threat hunting query packs. Pre-built query sets aligned to active threats, updated via the QUERYVAULT data repo.
H3AD-OPS
Daily triage query library. Organized by data domain for running baseline checks at the start of a shift or during an investigation.
Shift handover report generator. Fills out a structured form and exports a formatted handover document.
Phishing investigation tracker with a 7-step workflow. Aggregates IOCs live as you work and persists state in localStorage across sessions.
H3AD-DF
Windows registry artifact analyzer. Paste registry key paths or exported registry data to identify persistence mechanisms and known-bad patterns.
MALBRIEF-AI is also part of H3AD-DF for forensic malware analysis. See the full entry under H3AD-AI / MALBRIEF-AI.
H3AD-IR
Phishing IR playbook. Nine investigation phases with decision trees, embedded enrichment tool links, KQL query templates, and escalation flows.
H3AD-LEARN
9-chapter structured course covering threat hunting methodology, frameworks, and hands-on detection query construction.
8-chapter course on Living Off the Land binaries. Covers attacker tradecraft, detection engineering, and APT campaign patterns.