It's been a while since I've written anything publicly. I used to be fairly active documenting what I was building as a developer, and somewhere along the way - between shipping products and then pivoting toward cybersecurity - I went quiet. This is me picking that habit back up, starting with the most honest thing I can write about: a small, beginner-level tool I just finished.
I'm not writing this to announce a launch. I'm writing it because documenting the learning is the actual point.
Where I'm At
I come from a full-stack development background - I've shipped a few SaaS products solo. Over the past several months I've been transitioning into cybersecurity, specifically working toward a SOC Analyst role. I'm doing hands-on labs on LetsDefend, going through ISC2 CC and Google Cybersecurity material, and generally trying to learn by doing rather than just collecting certificates.
One thing I noticed early: every SOC case follows a similar manual pattern. You get an IOC - an IP, a domain, a file hash - and you check it across two or three different threat intel sources by hand. VirusTotal here, AbuseIPDB there, MalwareBazaar if it's a hash. Same value, three tabs, three logins, three waits.
So as a first project bridging my dev background with what I'm learning in security, I built a small tool that does that lookup automatically.
What I Built (and What It Isn't)
IOC Enricher - paste an IP, domain, or hash, it queries VirusTotal, AbuseIPDB, and MalwareBazaar in parallel, and gives back a combined risk score with a plain-English AI summary.
I want to be upfront: this is not a novel idea. Tools like this already exist - some far more polished, built by people with actual SOC experience. I'm not claiming to have invented anything. What this project actually is: a way to force myself to touch real APIs, handle real failure cases, and understand the manual workflow well enough to automate a small piece of it.
It's a beginner project. I built it knowing that.
Live: https://ioc-enricher-abd.vercel.app/
Code: github.com/m-abdullah-06/ioc-enricher
What I Learned Building It
The stack itself was straightforward - FastAPI backend, Next.js frontend, Groq for the AI summary. Nothing exotic. The useful part was what went wrong.
MalwareBazaar, for instance, silently returned "not found" for every hash I tested - including ones I knew were malicious. My first assumption was that the hashes just weren't in their database. Turns out abuse.ch now requires an Auth-Key header on every request, and my code was getting a 401 that my error handling quietly swallowed. The tool wasn't broken - it just looked like it was working while giving me nothing.
That was the real lesson. Not the fix itself, which took five minutes once I found it, but the realization that a silent failure that looks like a valid result is worse than an obvious crash. If this were a real SOC tool and not a portfolio piece, that bug would mean telling someone a file was clean when it was never actually checked.
Why I'm Writing This Instead of Staying Quiet
I could've kept this to myself until I had something more impressive to show. But I think there's more value in documenting the beginner version honestly - partly for my own record of where I started, and partly because I know there are other people making the same dev-to-security switch who might find the process more useful than a polished result.
I'll keep building on this - bulk lookups, maybe Shodan integration, better error handling than the silent-failure lesson taught me I needed. But this version, the rough first one, is the one worth writing about.
More writeups coming as I close more SOC cases and keep building. Good to be back.
Muhammad Abdullah - learning SOC analysis, building things along the way. GitHub: m-abdullah-06