SOCrates enriches any IOC across multiple threat intelligence sources in one query. Paste an IP, domain, URL, or file hash and instantly get: • Enrichment from VirusTotal, Shodan, AbuseIPDB, OTX AlienVault, and URLScan.io • AI-powered triage verdict (Malicious / Suspicious / Likely Benign) with confidence level • Cross-source reasoning — what the data means together, not just what each source says • MITRE ATT&CK mapping with relevant technique IDs • Recommended next steps for analysts
No reviews yetBe the first to leave a review for SOCrates
Maker
📌
Hey everyone! 👋
I'm Tamerlan, a security engineer with 5+ years in SOC operations. I built SOCrates because I lived the problem every day.
When you're a SOC analyst and an alert fires, the first thing you do is check the IOC - open VirusTotal in one tab, Shodan in another, AbuseIPDB in a third, then OTX, then URLScan. Five tabs, five logins, five different data formats. Then you sit there mentally piecing it all together: "OK this IP is flagged in VT, but Shodan says it's AWS, and the abuse reports are 8 months old... so is this actually bad?"
That mental correlation is the real time sink. Not the lookups - the thinking.
So I built SOCrates to do exactly that. One query, all sources, and an AI layer that cross-references the data and tells you what it actually means together. Not just a data dump - a triage recommendation with reasoning.
I posted about this on Reddit a few days ago asking for feedback and the response shaped the product significantly:
- "Enrichment is table stakes, the value is in the correlation" → so I focused the AI on cross-referencing, not summarizing
- "Telegram is blocked in most SOC environments" → so I built a web version
- "Make it compact, dashboard-style" → so I redesigned the layout
It's free, no signup needed. Just paste an IOC and go.
Would love your feedback — what's missing? What would make you use this daily? Roast it if it sucks, I'd rather know now 🙏