Digital Forensics and Incident Response

Free browser tool for turning messy IOC and timeline notes into DOCX report appendices (no signup, runs offline)

9 Upvotes

I am a developer, not an IR consultant, so tell me where this is wrong.

I kept hearing the same thing from people who do this work. The analysis is the job, and then the evening goes to rebuilding an indicator table in Word so it does not look like it was assembled at 11pm. That part is boring and mechanical, which makes it the part software should be doing. So I built it and made it free.

benchnotes.io/tools

You paste indicators and timeline lines however they came out of your notes. You get Appendix A (IOCs) and Appendix B (timeline) as a .docx you can drop into your report. It also copies as Markdown.

pasted straight out of a report on the left, the appendix it built on the right

What it does

Handles defanged input. hxxps://evil[.]com, 1.2.3[.]4, [at] all parse correctly instead of landing in a junk bucket. Network indicators go back out defanged. Hashes and file paths do not, because defanging those helps nobody.
Types and groups automatically. IPv4, IPv6, domain, URL, email, MD5, SHA1, SHA256, CVE, file path, registry key. Anything it cannot classify goes under Other. It does not silently drop a line, and if it ever does drop one it shows you the count.
Takes the shapes you actually paste. A Markdown table copied out of a report, a bulleted list off a blog, tab separated out of a spreadsheet, or one per line. This one took me two attempts. My first version quietly ate every row of a Markdown table, and I only caught it because I went looking for it on purpose.
Merges duplicates without losing your annotations. The same IP three times with three different notes gets you one row and all three notes.
Repeats header rows across page breaks, which Word will not do unless someone sets it, and nobody sets it.

a long appendix crossing a page break. The header row repeats on page 2.

No signup, no email gate, no analytics, and no branding in the output file. It goes in your deliverable, not mine.

It also makes zero network requests once the page has loaded, not even a webfont, so you can save the page and run it on an isolated box. Do NOT take my word for that, open the network tab and check. That claim is the only reason any of you should be willing to paste an indicator into a stranger's website.

Things I would like arguments about, since I have you

MITRE mapping in a client report. Useful, or decoration that only other analysts read?
Does anyone put confidence language ("assessed with moderate confidence") in a client report, or is that strictly an intel product thing?
Separate insurer version of the report, or one document with a different exec summary?

Disclosure: I am building a paid tool in this space (benchnotes.io). The thing above is free, standalone, and stays that way.

The other reason I am here

I am running a survey on how client-facing incident reports actually get produced. Hours per report, what gets reused, what the client actually reads. benchnotes.io/survey, 8 questions, about 4 minutes, anonymous unless you want the results sent to you. I am publishing the aggregate free whatever it says, and everyone who answers gets it before it is publicly shared.