Monocle documentation

Overview

Monocle has two main tabs and a settings area:

Getting started

1. Open Monocle and press ⌘1 for Search.
2. Paste an indicator such as 8.8.8.8, example.com or a file hash.
3. Pick a lookup site from the list to open it in your browser.
4. Press ⌘2 for Notes, and ⌘N to start a new note. Use ⇧⌘N to start from a template.
5. Optionally add API keys under Settings → Integrations to see results inline.

Search

Type or paste into the search field. It accepts IPs (IPv4 and IPv6), domains, URLs, file hashes, ports, emails, user agents, MAC addresses, ASNs, certificate hashes and CVE IDs. You can also drag text or files onto the window.

• URLs, host:port and CIDR ranges: Monocle extracts the host or IP inside and looks that up. The interface tells you when it has done so.
• Defanged input: values such as hxxps://evil[.]example or user[at]example[.]com are refanged automatically before lookup.
• Files: dropping a file computes its hash so you can look the file up without uploading it.
• Type override: if detection fails or guesses wrong, choose the type from the dropdown. The message "Couldn't detect type" means no type matched.

Indicator detection

Lookup resources

For each detected type Monocle lists curated lookup sites under Search. Selecting one opens the indicator on that site in your browser. The Integrations column shows which integrations can return results inline for that type. Monocle does not send the indicator anywhere until you open a site or enable an integration.

Integration results

When an integration is enabled and has credentials, a result card appears under the search field with a summary and a link to the full record. Cards are listed alphabetically: Censys, DNSdumpster, Have I Been Pwned, MalwareBazaar, MISP, OpenCTI and VirusTotal. See Integrations for setup.

Notes

Notes are Markdown documents that autosave as you type. The sidebar lists your notes grouped by recency, with pinned notes at the top. Each row shows the first line of real content as a subtitle.

• Create a note with ⌘N.
• Rename or delete from the Note menu or the context menu.
• Toggle the notes list with ⌥⌘S; drag its edge to resize.
• Toggle a rendered preview with ⇧⌘P.
• Text direction can be Automatic, Left to Right or Right to Left (Settings → Notes), which helps with Arabic, Hebrew and similar languages.

Templates

An empty note offers templates to begin from, or choose New from Template (⇧⌘N) to open a filterable picker: type to filter, arrow keys to move, Return to create.

You can also save your own templates; they appear in the picker, and right-click lets you delete them. Applying a template to a note that already has content asks you to confirm replacing it. Use Next Blank Field (⌘J) to jump through the blank fields of a template, and Insert UTC Timestamp (⌥T) to stamp the current time.

Formatting

Indicators sidebar

Toggle with ⌥⌘I. Monocle scans the open note and lists every indicator it finds, in order of first appearance, as IP, Domain, URL, Hash (labelled MD5, SHA-1 or SHA-256), Email, CVE or MAC. File names like report.pdf are not mistaken for domains.

• Look Up in Monocle sends the value to the Search tab.
• Copy copies the refanged value.
• Select in Note highlights every occurrence.
• Defang all in note / Refang all in note converts every indicator in place, or toggle them one at a time.

Find & search notes

• ⌘F opens the find bar inside the current note; ⌘G and ⇧⌘G move between matches; Esc closes it.
• ⇧⌘F searches all notes by title and content, showing a snippet for each match. Use the filter is:pinned to list only pinned notes.

Pinning & deleted notes

Pinned notes stay at the top of the list. Deleted notes move to Deleted and are kept for 30 days, so you can restore them. Empty permanently removes everything in Deleted.

Sharing & export

Use the share button or a note's context menu:

• Copy note: the note as written.
• Copy for ticket: defanged, plain text, ready to paste into a ticketing system.
• Save as .txt / .md.
• Send to Bear, Slack or Discord: appear once the connector is enabled.

To back up everything, use Settings → Notes → Export notes, which writes a single JSON file.

Defanging

Defanging makes indicators safe to share by breaking clickable or resolvable forms. Monocle understands and produces these patterns:

When refanging, Monocle accepts [.], (.), {.}, [dot], [at], (at), [:] and hxxp. Turn on Defang on export in Settings → Notes to defang automatically whenever a note leaves the app.

Connectors

Connectors send a note to another place. Configure them in Settings → Connectors.

Webhooks post the note text as JSON and report the HTTP status if the request fails.

Integrations

Integrations query threat intelligence platforms directly and show results in cards on the Search tab. Enable each one and enter credentials under Settings → Integrations.

Keyboard shortcuts

All shortcuts below are the defaults and can be changed under Settings → Shortcuts. A shortcut must include ⌘ or ⌃ so it can't interfere with ordinary typing, and Monocle warns you about conflicts.

Settings

Settings has its own search field to jump straight to an option, and Up/Down arrows move between sections.

Troubleshooting