Scripts

PowerShell modules and one-offs I've built or adopted. Most live inside the SOC Dashboard project. Click any heading to jump to its writeup once published.

SOC operations & KQL

Invoke-KqlPS

PowerShell · KQL helper · SQLite backend

Translates a subset of KQL into SQL and runs it against a local SQLite lab database. Lets you practice hunting queries without burning Sentinel ingest budget.

powershellkqlsqlite

Build-KqlLabDb

PowerShell · data prep

Bootstraps the lab SQLite database from the bundled CSV log samples (DeviceLogonEvents, DeviceProcessEvents, SecurityAlert, SigninLogs, etc.).

powershelllab

KqlBuilder & KqlTemplates

PowerShell · query authoring

Composable query builder plus a library of starter KQL templates for common SOC questions (suspicious sign-ins, parent-child process anomalies, rare image loads).

powershellkqltemplates

Threat intel & enrichment

SecIntel.ThreatIntel

PowerShell · enrichment library

Unified wrapper around AbuseIPDB, urlscan.io, NIST NVD, Team Cymru hash lookups, and the NSRL. One consistent interface, cached responses, pluggable settings.

powershellthreat-intelapi

SecIntel.DailyBrief

PowerShell · reporting

Pulls the day's relevant CVE/KEV/EPSS movement plus enrichment data and renders a digest. Run as a scheduled task to land a fresh brief in your inbox each morning.

powershellcvekevepss

Update-CveKevFeed & Update-EpssFeed

PowerShell · feed sync

Mirror CISA's KEV catalog and FIRST.org's EPSS scores locally. Designed to run idempotently — safe to schedule.

powershellcisa-kevepss

Frameworks

MitreAttackExplorer

PowerShell · MITRE ATT&CK

Offline browser for the ATT&CK framework. Search techniques, list sub-techniques, map to data sources, dump filtered JSON for downstream tooling. Useful when you want a quick lookup without opening the ATT&CK Navigator.

powershellmitreattack

Update-CveAttackMap

PowerShell · cross-mapping

Joins CVE records to ATT&CK techniques where mappings exist, producing a lookup table that's handy when prioritizing patching against observed adversary behavior.

powershellcvemitre

Source for these modules lives in the SOC Dashboard repo (link to come once it's public). Everything is MIT-licensed unless a file header says otherwise.