Look up an indicator. Write it down. Work in one app.

Monocle is a native macOS application designed for threat intelligence and investigation. It provides integrations and connectors, as well as a notes editor for use during investigations.

Check indicators

Drop in an IP, domain, URL, file hash, email, CVE, MAC address, ASN, or certificate hash. Monocle detects the type and lists matching lookup sites, plus live results from the integrations you connect.

  • Defanged input just works. Values like user[at]example[.]com are refanged before lookup.
  • Curated lookup sites. Over 20 for IP addresses alone, including AbuseIPDB, GreyNoise, Shodan and VirusTotal.

Take Notes

A Markdown notebook that autosaves your work and provides templates tailored to your tasks.

  • Start from a template. Alert investigation, incident triage, malware analysis, phishing report, threat hunt and shift handoff. Save your own, too.
  • See every indicator. The indicators sidebar lists each IP, domain, URL, hash, email and CVE in the open note. Look one up, copy it, or defang the whole note in one click.
  • Share it safely. Copy for a ticket as defanged plain text, save as .md or .txt, or send to Slack, Discord or Bear.

Bring your own intelligence sources

Add an API key and results appear as cards under your search, with a link to the full record.

  • Censys
  • DNSdumpster
  • Have I Been Pwned
  • MalwareBazaar
  • MISP
  • OpenCTI
  • VirusTotal

Want more detail?

The documentation covers setup, integrations and connectors, and the notes editor in more depth.

Documentation