About SockAnalyst

What it is

SockAnalyst is a free threat-intel site that turns each day's breaches and actively exploited vulnerabilities into short Patch Now playbooks: what happened, who's affected, the fix, a hunt check with copy-paste Splunk and Microsoft Sentinel queries, the CISA KEV deadline and the sources. It also tracks every incident in one breach tracker and shows upcoming CISA KEV due dates.

Who it's for

SOC analysts, threat hunters, incident responders, security engineers and other cybersecurity professionals who need to know what to patch, hunt or warn users about today, plus people working toward their first SOC role.

How stories are sourced and verified

• Every playbook cites at least two sources, primary first: the vendor notice, CISA advisory or the affected company's own disclosure, then secondary reporting.
• IOCs (IPs, domains, hashes) are only listed when a source publishes them. We never invent indicators, scores or numbers.
• CVSS scores come from NVD and KEV deadlines from the official CISA KEV feed.
• One page per incident: when a story develops we add a dated update to the original playbook rather than publishing a duplicate.
• Hunt queries are starting points; field names vary, so tune them before production use.

When it updates

The site is updated once a day, every morning at 6:00 AM Central Time. Last updated: Nov 4, 2026, 6:00 AM CT.

Corrections policy

If we get something wrong, we fix it in place on the same page and add a dated update note explaining what changed. Spotted an error? Tell us on X at @SockAnalystHQ.