Windows 10/11
64-bit (x64) PCs only
Official GoChannel Desk website
Indicators of compromise, searched in your own logs
GoChannel Desk 2.9.22 is a Windows agent that writes an IOC list from a report, searches copies of your own logs for it and shows each step as a card you can review.
Search the log copies for every address and domain in iocs.txt and write a findings note.
- list_dir
logs-copyfiles listed - read_file
iocs.txtlist read - grep
192.0.2.44 in logs-copy3 matches - read_file
logs-copy/fw.logcontext read - write_file
findings-note.mdsaved
Waiting for your OK before the next stepRejectAccept
2.9.22
Released 28 October 2026
About 34 MB
Portable file about 25 MB
None
No sign-up needed to run it
Three modes
Auto-run, Ask first, Plan only
No telemetry
Chats and keys stay on the PC
Indicators of compromise you can check on your own PC
Indicators of compromise are the traces a breach leaves behind: file hashes, IP addresses, domain names, URLs, file names, registry keys and scheduled task names. Each one is a clue. After a report names them, you search for each one in logs and files you own, for example a Security event 4688 that records a new process. A match is a lead, never a verdict.
Turn a published report into iocs.txt
Ask GoChannel Desk to find a published report with web_search, fetch the page with http_get and write_file a new iocs.txt with one indicator per line. IOCs security researchers publish are often defanged, with hxxp in place of http and [.] in place of a dot, so nobody clicks them by accident. The agent restores normal form. edit_file shows a diff for every change, and ocr reads the text when the table is only a screenshot. Run it in Ask first and read each md5, address and domain line before you accept.
Tool trace
web_search published advisory → results found
http_get advisory page → page read
write_file iocs.txt → saved
edit_file iocs.txt → diff shownSearch log copies for every indicator
Copy the exported firewall and DNS logs into the working folder first, so the originals stay untouched. list_dir and glob find the log files, then grep searches them for each address and domain in iocs.txt. Each hit is a lead. read_file opens the log around a hit, so you see the lines before and after it with their timestamps and can judge whether the connection came from a machine you know. Choose Plan only to read the searches first, then check the first 3 hits by hand before you write anything down.
Tool trace
list_dir logs-copy → files listed
glob *.log → logs found
grep 192.0.2.44 → 3 matches
read_file logs-copy/fw.log → context readHash a file instead of opening it
Do not open it. Identify a suspicious file by its hash instead: Shell runs certutil -hashfile on a copy of the file, using the same hash type as your list, and reports the real exit code, while grep searches iocs.txt for the printed md5 value. A matching hash is a lead, whereas a different hash proves little because any rebuild of a file changes it. findstr can search a text export for the same value. Use Plan only to read the command before it runs, and remember that Ask first pauses only before actions that change something.
Write up what you found
AI can help with digital forensics work, but a person still has to read the evidence and decide what a match means. task can run sub-agents on separate log folders in parallel, and write_file saves a findings note with each indicator, file, line and time, including any Security event 4625 lines you matched. When you share it, copy each indicator as a defanged IOC, with hxxp in URLs and [.] in addresses and domains. If a hit looks real, follow your incident-response plan: isolate the machine, keep the evidence and tell your security team. It removes no malware.
How it differs from a chat assistant
Chat assistants usually describe steps. GoChannel Desk 2.9.22 runs the searches itself and shows each one as a card with its real result, so you review actual output instead of a description.
| Typical chat assistant | GoChannel Desk | |
|---|---|---|
| Searching logs | Suggests a command and leaves you to run it | Runs grep over your log copies and shows the matches |
| Hash checks | Describes how to hash a file | Runs certutil on the file and reports the real exit code |
| The IOC list | Prints a list in the chat window | Writes iocs.txt and shows a diff for every edit |
| Control | You run every step yourself | Ask first pauses before changes; Plan only changes nothing |
How it works
- Install GoChannel Desk on Windows 10 or 11 and compare the installer's SHA-256 checksum with the published manifest.
- Connect a model: a cloud provider, a model on your PC or the built-in one, then press Test.
- Choose a working folder that holds copies of your logs and your iocs.txt list.
- Describe the search, pick Ask first or Plan only, and review each card and diff before you accept.
Who uses it and when
Students and self-taught defenders who practise on their own lab PCs are the first group. A text file is enough. Anyone working through an advisory on indicators of compromise in cyber security can paste its list into iocs.txt and search copies of their own logs, including event 4625 failed logons, without writing a script first.
Small-team admins who inherited security duties are the second group. Reports land without warning. An admin who searches for indicators of compromise cyber security usually wants a plain list to check against one office server or a few workstations, plus a findings note to hand to whoever responds.
Analysts in a security team can use it as a scratchpad for first searches before they move to their full tooling. The interface speaks 13 languages. It does not detect threats in real time and it is not a threat-intelligence feed, so it sits beside your monitoring rather than replacing it.
Common questions about IOCs
What are indicators of compromise?
They are pieces of evidence that a system may have been breached or infected, such as a file hash, an IP address, a domain name, a URL, a file name, a registry key or an email sender. IOC is the short form. Defenders search for them after a threat has been reported, and a match means investigate, never confirmed breach.
Is gocodesy.com the official GoChannel Desk website?
Yes, gocodesy.com is the official GoChannel Desk website. Download the original build from this site and compare its SHA-256 checksum with the published manifest before you run it. Never skip the checksum. Questions go through the Send feedback button inside the app.
Is an IOC in cyber security the same as an indicator of attack?
No. An IOC records an artifact that was seen, such as a hash or a domain, while an indicator of attack describes behaviour, such as a program starting at an odd time. Both are leads to investigate, and neither proves a breach on its own.
Does a clean search mean my system is clean?
No. A search finds only what is in the logs you give it and the indicators you list, so zero matches never proves a system is clean. Attackers change addresses and domains often, and a rebuilt file has a different hash.
Can GoChannel Desk detect threats in real time?
No. GoChannel Desk is not a monitoring tool and not a threat-intelligence feed. It works on exported logs and files you own when you ask it to, it never scans other networks, and it does not remove malware by itself.
Which logs can it search?
The logs you export and copy into the working folder: firewall, DNS, proxy, web server and application logs, plus the Windows Event Log exported to text or CSV. Useful events include 4624 and 4625 for logons, 4688 for new processes, 4698 for scheduled tasks and 7045 for installed services. Work on copies.
Does GoChannel Desk send my logs anywhere?
Yes, if you choose a cloud model: the log lines the agent puts in a prompt are sent to that endpoint. With a local model nothing leaves the machine. Chats, working folders and API keys stay on the PC, and secrets in tool output are redacted before they reach the model. There is no telemetry.
Try it on a copy of your logs
Download version 2.9.22 for Windows 10 or 11 and try it on copies of your own logs, starting in Plan only mode so you can read every search before it runs. Setup is about 34 MB.
Download GoChannel Desk for Windows ↗Pages worth opening next
Every page is also available in 20 languages.
What GoChannel Desk can do with your files ↗ Connect a cloud, local or built-in model ↗ A step-by-step IOC search guide ↗ Download and verify the installer ↗ Questions about IOCs and the app ↗ What stays on your PC ↗
