RAIN

Right-click Analyst's IOC Navigator is a SOC tool to speed up hunting of IOCs

Highlight. Hunt. Done. Every analyst knows the dance: copy the IP out of the alert, fix the [.] someone defanged it with, open VirusTotal, paste, search, open AbuseIPDB, paste again, open Shodan, paste again. Somewhere around tab fourteen you forget which indicator you were chasing. RAIN (Right-click Analyst's IOC Navigator) kills that dance. Highlight an indicator anywhere in your browser and RAIN cleans it, classifies it, and launches it into 17 threat intelligence tools, including a ready to run KQL query inserted straight into Microsoft Defender Advanced Hunting. It is named after a particularly relentless miniature dachshund. Like her, it is small, fast, and does not let go of a scent. FOUR WAYS TO HUNT 1. Right-click menu: highlight an IOC and choose "RAIN - Hunt IOC". If a site hijacks the right-click menu with its own, hold Shift while right-clicking and RAIN forces the browser's native menu through. 2. Floating hunt button: highlight text and a small RAIN button appears beside it. One click opens the hunt menu, even on sites that block the context menu. 3.Hunt hotkey (Alt+R, rebindable): opens the hunt menu for your selection without touching the mouse. 4. Side panel: a docked hunt workspace that opens automatically when the in-page menu isn't possible (browser pages, canvas apps like Google Docs, portals that hide their selection). Paste any IOC, pick the type, hunt. AUTOMATIC REFANGING AND CLEANING RAIN refangs indicators on the fly: hxxps:// and meow:// protocols, bracketed and verbal dots ([.] (.) {.} [dot]), colons, at-signs ([at] [@]), plus stray quotes, brackets, and parentheses highlighted along with the IOC. What you highlight is never what limits you. SMART CLASSIFICATION IPv4 and IPv6 addresses, domains and URLs, MD5/SHA-1/SHA-256 hashes, email addresses and UPNs, and CVE identifiers are detected automatically. Guessed wrong or unrecognised? Every menu includes a one-click type switcher. MICROSOFT DEFENDER KQL INJECTION Choose a Defender AHQ hunt and RAIN opens Advanced Hunting and inserts a complete KQL query with your indicator already substituted in. The query is inserted, never executed: you review it and press Run. Every template is fully customisable per indicator type. YEET SEARCH (BULK LOOKUP) Throw the indicator at every tool in its category at once. Tabs open in the background and land in a single collapsed, colour-coded tab group (IP = blue, Domain = green, Hash = orange, CVE = red). Triage when ready, close the group in one click. ANALYST CONTROL CENTER A dark, distraction-free dashboard built from the icon's own palette. Edit and save custom KQL templates, toggle the floating button and Shift+right-click behaviour, and manage your hotkey. PRIVACY, PLAINLY RAIN sends no telemetry and stores nothing outside your browser's local extension storage. The only data that ever leaves is the indicator you deliberately send to the tool you clicked. Script injection is restricted to security.microsoft.com; hotkey access is scoped to the single tab you invoke it on.