Scripts

PowerShell modules and one-offs from the SOC Dashboard project. Click any heading to jump to its writeup once published.

SOC operations & KQL

Invoke-KqlPS

PowerShell · KQL helper · SQLite backend

Translates a subset of KQL into SQL and runs it against a local SQLite lab database. Lets you practice hunting queries without burning Sentinel ingest budget.

powershellkqlsqlite

Build-KqlLabDb

PowerShell · data prep

Bootstraps the lab SQLite database from the bundled CSV log samples (DeviceLogonEvents, DeviceProcessEvents, SecurityAlert, SigninLogs, etc.).

powershelllab

KqlBuilder & KqlTemplates

PowerShell · query authoring

Composable query builder plus a library of starter KQL templates for common SOC questions (suspicious sign-ins, parent-child process anomalies, rare image loads).

powershellkqltemplates

Threat intel & enrichment

SecIntel.ThreatIntel

PowerShell · enrichment library

Unified wrapper around AbuseIPDB, urlscan.io, NIST NVD, Team Cymru hash lookups, and the NSRL. One consistent interface, cached responses, pluggable settings.

powershellthreat-intelapi

SecIntel.DailyBrief

PowerShell · reporting

Pulls the day's relevant CVE/KEV/EPSS movement plus enrichment data and renders a digest. Run as a scheduled task to land a fresh brief in your inbox each morning.

powershellcvekevepss

Update-CveKevFeed & Update-EpssFeed

PowerShell · feed sync

Mirror CISA's KEV catalog and FIRST.org's EPSS scores locally. Designed to run idempotently - safe to schedule.

powershellcisa-kevepss

Frameworks

MitreAttackExplorer

PowerShell · MITRE ATT&CK

Offline browser for the ATT&CK framework. Search techniques, list sub-techniques, map to data sources, dump filtered JSON for downstream tooling.

powershellmitreattack

Update-CveAttackMap

PowerShell · cross-mapping

Joins CVE records to ATT&CK techniques where mappings exist, producing a lookup table that's handy when prioritizing patching against observed adversary behavior.

powershellcvemitre

Source for these modules lives in the SOC Dashboard repo. Everything is MIT-licensed unless a file header says otherwise.