Painted Wolf Code
AI coding you control — with the models you already use.
Painted Wolf Code
SOC Toolkit
w
workspace
Nothing to trust
Balanced
glm-5p2-fast
$0.01
New chat
Chats
- CLI Tool for SOC Analyst
All chats
1
Context
- Files
- Search
- Security scanners
- Cost
- Blueprints
- Artifacts
- 1 more
Settings
Layout
Progress
Workflows
Git
Workers
Build me a CLI tool that would be useful for a SOC analyst
Let’s start with the SOC workflow you want to improve. Pick a direction, or describe your own:
Waiting for your answer in the composer…
Your input
What kind of CLI tool would be most useful for your SOC work?
Log triage toolkit — parse logs and flag brute-force patterns
IOC hunter — scan files for indicators against a threat list
Incident timeline builder — merge events into one chronology
Quick vet bundle — check IPs, domains, and hashes
Press Enter to submit your answer
⤷ Not listed? type below and Send.
Describe another answer…
Painted Wolf Code
SOC Toolkit
w
workspace
Nothing to trust
Balanced
glm-5p2-fast
$0.07
New chat
Chats
- CLI Tool for SOC Analyst
All chats
1
Context
- Files
- Search
- Security scanners
- Cost
- Blueprints
- Artifacts
- 1 more
Settings
Layout
Files
Review
- @workspace
- decode_test.go + ⋯
- decode.go + ⋯
- defang_test.go + ⋯
- defang.go ⋯
- epoch_test.go + ⋯
- epoch.go • ⋯
- go.mod + ⋯
- hash.go ⋯
- helpers.go ⋯
- ioc_test.go ⋯
- ioc.go ⋯
- ip_test.go + ⋯
- ip.go + ⋯
- logparse_test.go + ⋯
- logparse.go + ⋯
- main.go ⋯
- README.md + ⋯
- demo.txt − Revert ⋯
- test_events.jsonl − Revert ⋯
- test_sample.txt − Revert ⋯
File summary
ip.go
⌃
Preview
ip.go
×
test_events.jsonl
×
logparse.go
×
ioc_test.go
×
soc
×
defang.go
×
epoch.go
×
helpers.go
×
decode_test.go
×
›
7
@workspace
/
ip.go
21m ago
Current
Full file
Compare: Before ▾
1
213
214
215
216
217
218
219
220
221
222
223
224
⋯ 211 lines
fmt.Printf("CIDR: %s\n", ipnet.String())
fmt.Printf("Network: %s\n", ipnet.IP)
fmt.Printf("Mask: %s (/%d)\n", net.IP(ipnet.Mask), ones)
fmt.Printf("Version: IPv%d\n", bits/8*2)
if ipnet.IP.To4() != nil {
fmt.Printf("Version: IPv4\n")
} else {
fmt.Printf("Version: IPv6\n")
}
start, end := cidrRange(ipnet)
fmt.Printf("First: %s\n", start)
fmt.Printf("Last: %s\n", end)
⋯ 60 lines
Historical version
16 open
Go
7.2 KB
Wrap
Line numbers
Turn 1
Build me a cli that a SOC team would find useful
Show in chat
17 of 45
Turn 1
Turn 2
6 new steps
Painted Wolf Code
SOC Toolkit
w
workspace
Nothing to trust
Balanced
glm-5p2-fast
$0.11
New chat
Chats
- CLI Tool for SOC Analyst
All chats
1
Context
- Files
- Search
- Security scanners
- Cost
- Blueprints
- Artifacts
- 1 more
Settings
Layout
Cost
Refresh
Export CSV
Estimated usage · models-dev · as of Sep 4, 2026, 7:35 AMProject usage
SOC Toolkit
Figures are estimates, not invoices. Archived sessions are included.
Composition
Where usage goes
By estimated cost
Coordinator
46%
$0.05 · ~5M in · ~56K out
Workers
53%
$0.06 · ~6.1M in · ~137K out
Summarizer
0%
<$0.01 · ~15K in · ~3.4K out
By tokens
Coordinator
44%
~5M in · ~56K out
Workers
55%
~6.1M in · ~137K out
Summarizer
0%
~15K in · ~3.4K out
Session guardrails
OffWarn, then land
Applies to every session in this project. At the limit, a running session can land its work before pausing. This is a per-session limit.
Warnings and stops require priced usage. Unpriced usage is never presented as protected.
Enable per-session spend limit