More than a dashboard.
An entire field workbench.

Switch between loaded applications in one browser tab without discarding their in-page working state.

One launchpad for local helpers, planning templates, security references and the curated publisher catalogue.

Build, export and preview/import profiles for a chosen set of tools and working references.

Edit a structured case-notes template and export your work as Markdown.

Opt-in dashboard action log, with visible export and delete controls; it does not watch other apps.

Choose palettes, contrast, background styling and motion preferences across the workspace.

Run supported local workflows from the browser or portable folder; external data feeds need connectivity.

Explicit, reviewed WinGet-based installation script for selected Windows applications; not an automatic full installer.

Workspace, security review, practice labs, PC/network help, quick checks, installation and themes.

Open supported sections separately with theme preferences passed through validated appearance settings.

Keeps loaded modules open while switching; closing or refreshing still requires explicit exports for work you want to keep.

Record the case reference, client, lead analyst, written authorisation, scope, exclusions and work window.

Log applications, hosts, domains and networks with explicit in-scope, excluded or pending status.

Record severity, asset, source, description and analyst verification for manually reviewed observations.

Keep reported findings separate from what an analyst has independently verified.

Track owners, proposed fixes, status and due dates alongside findings.

Record follow-up validation and unresolved items; changing status does not prove a fix.

Search and filter findings by text, verification state and work status.

Move the structured record between sessions or devices through bounded file import/export.

Generate a readable report for another analyst, customer or internal team.

Choose to save case data in browser storage on that device; this optional cache is not encrypted.

Process selected evidence files inside the browser; no server upload of the selected file content.

Build an inventory of file names, sizes and SHA-256 digests.

Up to 100 files, 64 MiB per file and 256 MiB total in the inspected preview build.

Import a compatible previous FieldKit Evidence JSON manifest and compare file digests.

Review progress, cancel processing and clear the local batch.

Export records for an external evidence handoff, with optional analyst notes.

A matching digest shows file-content equality, not collection provenance or chain of custody.

Manually send a browser HEAD request to one exact HTTPS endpoint; credential-free and no redirects.

Save or recall an explicit health-check URL and timeout.

Generate fixed read-only diagnostic commands for supported systems; no tunnel inspection.

Review exported nginx/Apache-style access logs or the supported CSV format locally.

Bound imported files and rows; inspect accepted and rejected records.

Adjust review thresholds for rate spikes and errors in historical data.

Summarise top client fields, URL paths, HTTP response codes and busiest UTC minutes.

Record qualified indicators rather than assuming a live threat or attribution.

Document providers, escalation, readiness, availability objectives and response responsibilities.

Jump to guidance from ASD/ACSC, Cloudflare, AWS and Microsoft Azure.

Create a bounded JSON or Markdown record of locally reviewed network data.

Import supported Nmap XML and OWASP ZAP JSON outputs for local analyst review in the dashboard.

No live packet sensor, automatic firewall changes, VPN inspection or DDoS enforcement are provided.

Collect and organise public-world reporting through an analyst-focused briefing workspace.

Run an explicit bounded GDELT DOC 2.0 query with up to 30 links; no automatic refresh.

Filter a reporting request by location mentions, reporting focus and a 24-hour, 48-hour or 7-day window.

View provider/index context; independently check publication time and factual claims.

Review basic source counts and saved reporting records from a manual collection.

Import a previously exported structured briefing and use a starter template.

Separate observations, assessment, confidence and unresolved questions.

Keep track of independent corroboration, uncertainty and provenance checks.

Save links for follow-up without implying the underlying claims are verified.

Produce a bounded, readable handoff including selected links, notebook and checklist.

References to ReliefWeb, HDX, ACLED and UCDP; these are official links, not connected authenticated feeds.

Define scope, discover sources, review findings, verify, minimise collected data and report.

Curated links to OSINT Framework, ICANN Lookup, certificate transparency, ExifTool, Maltego and others.

On-demand published reporting is not a verified real-time event tracker, emergency alert system or continuous monitoring service.

Hash a user-selected file and optionally compare it to a publisher-provided digest.

Inspect pasted HTTP headers for common security-policy signals; no remote scan is performed.

Create, open, edit, save and lock a passphrase-encrypted local vault file in the preview.

Manually enter and manage local credential/configuration notes; does not scrape browser cookies.

Run local heuristic strength checks; no credential is uploaded.

Review possible hash types locally, without asserting a definitive format.

Find official Hashcat/John publisher guidance; those tools are separate downloads.

Generate SHA-256, SHA-384 or SHA-512 text digests using Web Crypto.

Generate test strings/bytes in the browser using supported cryptographic randomness.

Inventory cryptographic systems, owners and migration decisions; does not implement PQC or QKD.

Prepare and copy a prompt for an AI assistant you choose; the preview does not call an AI API.

Configure an authorised issuer endpoint and review a separately trusted publisher public key.

Import/export and verify signed offline access leases against a confirmed trust key in the preview.

Review signed release metadata when configured; this alone does not verify downloaded ZIP bytes.

Selected files, pasted logs and notes remain in the browser for supported offline flows; other services have their own policies.

No government accreditation, guaranteed incident detection or hosted scanner is claimed.

Choose a Kali lab route, prepare safe isolation and export a plan; does not install Kali or run scans.

Links to OWASP Juice Shop and PortSwigger Web Security Academy for controlled exercises.

Model a hypothetical wireless disconnect and recovery using scenario values; never transmits packets.

Document resilience and restoration tasks for a controlled home or lab environment.

Write an authorised hardware assessment and defensive tabletop brief; no attack payload creation.

Generate a defensive USB input-device risk checklist without building a keystroke payload.

Record consent-based network and device observations without changing router, BIOS or Windows settings.

Prepare checklist, backups, driver/reference inventory and safe recovery-media separation.

Record where recovery keys and backups are stored; avoid storing sensitive keys in plain case notes.

Plan the reference USB layout, launchers and safe off-grid use.

Getting started, package layout, supported profiles, explicit installers and official links.

Generate a clearly labelled, time-limited pretend terminal message for training or demonstrations.

Request release information on demand and review notes; a secure update service is still being built.

Host and service discovery for assets inside your approved scope.

Inspect protocols, troubleshoot applications, and review authorised packet captures.

Manually inspect HTTP requests and responses in a permitted test environment.

Open-source web application security testing with manual review workflows.

Intentionally vulnerable training app for local practice. Use the Kali Lab Builder's loopback-only Docker command.

Free web security learning materials and browser-based labs.

Web fuzzer for controlled testing against applications you own or have written permission to assess.

Automated SQL injection testing tool. Use only on a local training app or a documented authorised target.

Local, encrypted password vault for case credentials and lab logins.

Cross-device password manager with browser integration.

Offline hash cracking to audit password strength on hashes you own or are authorised to test. No installer package; manual .7z download.

Offline password auditing and recovery for hashes you own or are authorised to assess. No installer package; manual portable download.

Locally identify likely hash formats and related tool modes. An identification is a clue, not proof; do not submit sensitive hashes to third-party services.

Companion command-line utilities for authorised offline password-audit workflows. Use only with hash material and inputs you own or have written permission to assess.

The canonical categorised directory of open-source intelligence tools and sources — start here before anything else in this category.

Reads and strips EXIF/GPS/authorship metadata from images and documents.

Graph-based link analysis across OSINT data sources. Community Edition needs a free Maltego account; check current edition terms.

Gathers emails, subdomains, and names from public sources for a given domain. No Windows installer; runs via Python.

Automated OSINT reconnaissance across 200+ public data sources, with a local web UI. Python or Docker; no native Windows installer.

Checks a username's presence across public platforms. Limit use to your own accounts or an expressly authorised assessment; runs via Python.

Checks whether an email or domain appears in known public breach data.

Free scanner tier for personal, educational, and non-commercial use; Tenable currently limits it to 16 IPs per scanner. Check current terms.

Fast, template-based vulnerability scanner with community-maintained checks. No Windows installer package; manual binary or Go install.

Web server vulnerability/misconfiguration scanner. Runs on Windows via WSL2 or Strawberry Perl — WSL2 is the officially recommended route.

The standard pentest exploitation/validation framework. Official Windows installer exists but WSL2/Kali is commonly preferred; many AV engines flag it by design.

Full vulnerability-management stack; plan it as a separate scanner host rather than a tiny USB utility.

Checks supported source, filesystems, containers, and cloud-native targets for known vulnerabilities and misconfigurations.

Matches supported project dependency data to known open-source vulnerability advisories.

Checks TLS and cryptographic configuration on explicitly authorised servers.

Scans container images, filesystems, and software bills of materials for known vulnerabilities. Verify matches and affected versions before acting.

Reviews supported infrastructure-as-code and cloud configuration files for policy and security misconfigurations. Run on repositories you own or are authorised to assess.

Analyzes container images and local software artifacts for component inventory and known vulnerabilities. Docker account or supported Docker setup may be required.

Compare Windows policy settings with Microsoft security baselines; complements vulnerability scanning.

Security-focused Linux distribution. Start with an isolated virtual machine and verify downloads using Kali's published checksums.

Security monitoring, configuration assessment, file-integrity monitoring, and vulnerability visibility. A server and enrolled agents need separate deployment.

Evaluate supported Linux system configurations against SCAP security content. Compatibility depends on the operating system and content profile.

Audits cloud security configurations for supported providers. Requires carefully scoped cloud access; never place cloud credentials in FieldKit notes or prompts.

Checks Kubernetes node configuration against supported CIS benchmark guidance. It is designed for cluster nodes and usually needs Linux/container access and elevated privileges.

Static analysis, decompilation, cross-references, and binary investigation.

User-mode debugger for controlled analysis of Windows applications.

Browse and decompile managed .NET assemblies.

Identify file types and review executable-format metadata and packer clues.

Process Explorer, Autoruns, Sigcheck, TCPView, Procmon, and diagnostic utilities.

Create and test pattern-matching rules for local file triage.

Pattern-matching engine for malware research and file classification. Use detection rules and samples in an isolated lab; it does not disinfect files.

Edit scripts, detection rules, JSON, logs, and structured case notes.

Track changes to scripts, test plans, and research notes.

Static analysis for code patterns and common security issues. Review findings manually; coverage depends on rules and edition.

Checks repositories and files for likely hard-coded credentials and tokens. Review findings locally and rotate any confirmed exposed secret.

Identifies known vulnerabilities in supported project dependencies. Treat matches as leads and verify affected package versions.

Generates software bills of materials from container images, directories, and archives to support dependency inventory and review.

Checks open-source repositories for security practices and supply-chain risks. Treat scores as signals to investigate, not a verdict that software is safe or unsafe.

Encrypt an authorised evidence handoff or backup for named recipients using a separate local tool.

Linked resource; separate installation

Evaluate OpenPGP signing, signature verification, and encrypted file exchange within an agreed key-management process.

Linked resource; separate installation

Evaluate client-side encryption for a folder that will be synchronised through a chosen storage service.

Linked resource; separate installation

Decode, transform, hash, and inspect sample data or approved evidence with repeatable analyst recipes.

Linked application; not embedded in FieldKit

Map key establishment and digital-signature dependencies to the NIST algorithms when planning a cryptographic migration.

Planning reference; no algorithms implemented by this library

Build a cryptographic inventory, assign migration owners, and plan interoperability and performance evaluation.

Planning reference; no automatic discovery in FieldKit

Run a separate research lab to compare post-quantum key-encapsulation and signature implementations and performance.

Linked research library; separate build or installation

Evaluate ML-KEM support and application integration in a controlled cryptographic compatibility lab.

Linked implementation documentation; separate installation

Compare software-based PQC migration with the specialised hardware, authentication, and infrastructure questions raised by QKD proposals.

Planning reference; no browser QKD or quantum-computing capability

Validate an agreed asset and service inventory, then review exported observations against the written assessment scope.

Linked tool; separate installation and user-controlled execution

Plan and document authorised web-application validation, then bring exported findings into human review.

Linked tool; separate installation and user-controlled execution

Support manual web and API assessment with explicit target scoping and documented request/response evidence.

Linked vendor tool; separate installation and applicable licence

Map assessment objectives and detection-validation coverage to a shared technique vocabulary before a team exercise.

Planning reference; no technique execution

Evaluate endpoint telemetry, file-integrity monitoring, and security configuration assessment in a managed defensive environment.

Linked platform; separate infrastructure and agent installation

Query authorised endpoint state through a consistent SQL-style interface and retain reviewed output for an investigation.

Linked tool; separate installation and fleet configuration

Describe and review detection ideas in a portable rule format, then adapt them to the team's actual log sources and backend.

Linked rule ecosystem; separate backend and testing required

Evaluate file-classification and detection rules against approved sample sets without executing the samples.

Linked tool; separate installation

Equip team members with compatible hardware authentication keys and a documented spare-key enrollment and recovery process.

Separate hardware purchase; official vendor store

Observe Ethernet traffic in an owner-approved training or troubleshooting lab using a separate packet-capture station.

Separate hardware purchase; vendor page lists regional retailers

Build a small segmented lab and evaluate authorised port-mirroring traffic for a separate monitoring workstation.

Separate hardware purchase; official vendor product and buying page

Collect approved Wi-Fi survey, connectivity, and troubleshooting measurements with a dedicated field instrument.

Separate hardware purchase; official vendor product and buying options

Create a separately managed Linux lab endpoint for learning, approved service testing, or repeatable defensive exercises.

Separate hardware purchase; official product page lists approved resellers

Research whether a hardware authentication resale, integration, or managed-service business fits Yubico's published channel programme.

Application lead; no FieldKit relationship claimed

Research an affiliate programme for a security education website or social audience before deciding whether to apply.

Application lead; no FieldKit affiliate relationship claimed

Research a formal channel route for a business that plans to supply professional network testing hardware.

Application lead; no FieldKit relationship claimed