DDSOC

MSS Procedures

Managed security service runbooks, escalation paths, and standard operating procedures for shift work.

Documentation

SOC Triage Playbooks

Step-by-step alert triage workflows by detection category, severity, and escalation criteria.

Playbooks

SOC Comms Builder

Generate consistent client notifications, incident updates, and handoff summaries from templates.

Communications

ASM Dashboard

Attack surface management view of external assets, exposed services, and newly discovered risks.

Attack Surface

Cyber Tickets Dashboard

Dashboard showing SOC ticket status - only accessible from Dean Dorton IP's

Dashboard

Scorecard Project Dashboard

Dashboard showing Scorecard Project Board status - only accessible from Dean Dorton IP's

Dashboard

After-Hours Activity Tracker

Not as nefarious as it sounds - tracking escalations after hours to make sure we keep numbers down. Only available from Dean Dorton IP's

Dashboard

CrowdStrike

Falcon console for endpoint detections, host management, and real-time response sessions.

EDR

PagerDuty

On-call schedules, paging policies, and incident escalation across the analyst rotation.

Alerting

Umbrella

DNS-layer security, domain reputation lookups, and web filtering policy management.

DNS Security

Avanan

Email security console for phishing detections, quarantine review, and message trace.

Email Security

Okta

Identity provider administration, session review, MFA resets, and sign-on policy checks.

Identity

Microsoft

Defender XDR, Entra ID, and M365 security portals for cloud and identity investigations.

Cloud / XDR

Lima Charlie Query Builder

Build queries for the Lima Charlie webUI search box

Identity Triage

Identity — BEATS

Behavioral authentication triage suite for sign-in anomalies, token misuse, and account review.

Identity Triage

Endpoint — CrowdStrike Scripts & Queries

Curated RTR scripts and advanced event search queries for rapid endpoint investigation.

Endpoint Triage

Endpoint — Velociraptor

Forensic artifact collection with curated targets and modules for fast host evidence capture - this supercedes usage of LRC.

Forensics

Endpoint — D2FAP

Disk and data forensic analysis pipeline for automated evidence processing and enrichment.

Forensics

Endpoint — Process Grapher

Visualize process execution lineage and parent-child relationships from endpoint telemetry.

Visualization

Endpoint — Process Grapher Github

Github repo with scripts to generate input to Process Grapher GUI

Visualization

General — Cyber Chef (Private)

Tool used to manipulate and decode data

Visualization

WHOOPS

Post-incident review tracker for misses, lessons learned, and follow-up remediation items.

Reporting

DFIR Timeline Generator

Build normalized incident chronologies from artifacts and export report-ready timelines.

Reporting

ASM Windmill (Internal Only)

Internally deployed windmill instance responsible for all ASM operations

Infrastructure

ASM DDOS Windmill Poller

For DDSOC operations - this windmill instance handles all alert polling flows

Infrastructure

Windmill Webhooks

For DDSOC operations - this windmill instance handles all public incoming webhooks to collect data from Crowdstrike and LC

Infrastructure