The SOC Toolkit plugin provides cybersecurity professionals and SOC analysts with tools for IP reputation analysis and defanging directly within their notes. It scans IPv4 and IPv6 addresses, including defanged variants, and queries VirusTotal and AbuseIPDB APIs for reputation data. Results are cached locally to reduce API calls and displayed in a customizable format. Users can defang IPs in notes via commands or right-click menus, preserving original formatting. The plugin supports both full and last-dot defanging and integrates with the command palette and context menus for quick access.