Labs

Analyst tools

The four conversions that come up constantly in a triage, done locally.

Client-side only. No network request, no logging, no server.

That matters more than it sounds. The online converters an analyst reaches for mid-incident are exactly the ones you should not paste a live indicator into, because the indicator is evidence and pasting it hands a copy to a third party. These are the same conversions with no third party, and they keep working with the network off once the page has loaded.

Check it yourself rather than taking the claim: open your browser's network tab, run any of the tools below, and watch nothing happen.

Timestamp converter

One number, read four ways. Getting this wrong by a factor of a thousand, or by the 369 years between the Windows and Unix epochs, is the most common way a timeline ends up wrong.

Defang and refang

Paste an indicator to neuter it for a report, or paste a defanged one to read it back. Handles the usual conventions: hxxp, [.], [dot], [:] and (.).

Hash identifier

Length narrows the algorithm and never proves it. A 64-character hex string is SHA-256 or SHA3-256 or something else entirely that happens to be 32 bytes.

Base64 decoder

For the encoded command line in a PowerShell event. Accepts the URL-safe alphabet too.

These pair with the guided labs. If a conversion you keep needing is missing, say so in the community and it can be added.