~/themaxterone

tool

Script-SOCAnalystSuite

·3 min read
ScriptPythonSOC

Repository

gui_soc_suite-v3.py python script

Overview

SOC Analyst Suite — Fluent Edition is a desktop security investigation app built with a Windows 11 Fluent look (customtkinter). It brings into one window:

  • Microsoft Entra ID sign-in audits (single account and bulk).
  • Entra ID Protection risky user detection (High, Medium, Low, All).
  • Intigriti bug bounty IP verification.
  • AbuseIPDB threat intelligence lookups.
  • Concurrent API quota monitoring.

It runs with standard python.exe (no .pyw, which AppLocker / WDAC often block) and moves every network call, OAuth2 PKCE login and bulk lookup to background threads, so the interface never freezes.

Key features

  • Fluent GUI with rounded controls and an instant dark / light mode toggle.
  • Color-coded consoles: successes in green, threats and errors in red, rate limits in yellow, info in blue.
  • Single & bulk sign-in auditing: one UPN or a .txt with many accounts, exported to a unified CSV and an HTML report with a per-account breakdown.
  • Risky users scanner: pick the risk level, filter by Risk Updated (days ago) and launch a one-click bulk sign-in audit of every account found.
  • Prioritized IP threat engine:
    • Checks Intigriti first: confirmed researcher traffic skips AbuseIPDB (saves quota) and is left out of exports.
    • Low-confidence IPs (abuseConfidenceScore <= 10%) are dropped, so only actionable threats reach the reports and blocklist.
    • AbuseIPDB enrichment with in-memory cache, private / loopback range exclusion and automatic key rotation on HTTP 429.
  • Interactive HTML dashboards with metric cards, live search and filters (All, Success, Failures, Malicious, Suspicious, Clean).

Requirements

  • Python 3.8+ (standard Python or Anaconda).
  • Libraries: customtkinter, msal, requests, urllib3.
  • Microsoft Entra ID P2 for risky users (P1 for sign-ins).
  • Delegated permissions: AuditLog.Read.All and IdentityRiskyUser.Read.All.
  • Analyst role: Security Reader, Security Operator, Global Reader or Security Administrator.

Installation

bash
pip install customtkinter msal requests urllib3

Configuration

Edit the top of the script with your Intigriti token and AbuseIPDB keys:

python
# Microsoft Graph Command Line Tools official public Client ID
CLIENT_ID = "14d82eec-204b-4c2f-b7e8-296a70dab67e"
AUTHORITY = "https://login.microsoftonline.com/organizations"

# Intigriti Access Token (Company / Researcher IP Verification)
INTIGRITI_ACCESS_TOKEN = "YOUR_INTIGRITI_ACCESS_TOKEN"
INTIGRITI_API_URL = "https://api.intigriti.com/external/company/v2/iplookup"

# AbuseIPDB API Keys Pool
ABUSEIPDB_API_KEYS = [
    "YOUR_ABUSEIPDB_KEY_1",
    "YOUR_ABUSEIPDB_KEY_2",
    "YOUR_ABUSEIPDB_KEY_3"
]

Usage

cmd
cd "C:\Users\<YourUser>\Documents\iplookup"
python gui_soc_suite.py

Modules

Tab 1 · User sign-ins audit

Audit one email / UPN or load a .txt with many accounts (deduplicated automatically). Choose the lookback in days (default 15) and optionally enrich source IPs with AbuseIPDB. Reports are saved in signInsLogs/.

Tab 2 · Risky users

Query /identityProtection/riskyUsers by risk level and recency (default 7 days, 0 = all active detections), then run a bulk sign-in investigation over every detected account.

Tab 3 · IP threat searcher

Check a single IPv4 or a bulk .txt (mixed text and /32 masks supported), with optional Intigriti verification first. Outputs in abuseIpLogs/:

  • abuseipdb_<name>_<timestamp>.html — interactive dashboard.
  • extended_<name>_<timestamp>.csv — detailed results.
  • blocklist_<name>_<timestamp>.txt — ready-to-import firewall blocklist (IP/32).

Tab 4 · API keys status

Checks every AbuseIPDB key in parallel and shows its status (Active, Exhausted (429), Unauthorized (401)), remaining quota and reset time.

Output structure

text
├── gui_soc_suite.py
├── README.md
├── signInsLogs/
│   ├── signins_intel_<user>_<days>d_<timestamp>.csv
│   ├── signins_intel_<user>_<days>d_<timestamp>.html
│   ├── signins_intel_bulk_<N>accounts_<days>d_<timestamp>.html
│   └── signins_intel_RISKY_<LEVEL>_<N>accounts_<days>d_<timestamp>.html
└── abuseIpLogs/
    ├── abuseipdb_<sourcefile>_<timestamp>.html
    ├── extended_<sourcefile>_<timestamp>.csv
    └── blocklist_<sourcefile>_<timestamp>.txt

Troubleshooting

  • AADSTS65002 (preauthorization required): use the Microsoft Graph Command Line Tools client ID shown above, or register your own app with AuditLog.Read.All and IdentityRiskyUser.Read.All.
  • CERTIFICATE_VERIFY_FAILED behind a corporate SSL proxy: the suite disables urllib3 warnings and uses verify=False for outbound API calls.
  • Privacy: tokens stay in local memory, private IP ranges are filtered before any external query, and all reports are saved only to your disk.

View on GitHub ↗