IOCraft is a small Python CLI for extracting, normalizing, defanging, and exporting indicators of compromise from reports, tickets, paste files, and plain logs.
It is built for analysts who want a quick, offline way to turn messy text into a clean IOC table.
- Extract IPv4 addresses, domains, URLs, email addresses, MD5, SHA1, and SHA256.
- Refang common analyst-safe forms such as
hxxp://evil[.]example. - Defang output for safe sharing.
- Classify IPv4 addresses as public, private, loopback, multicast, reserved, or unspecified.
- Output table, JSON, CSV, or Markdown.
- Filter by IOC type.
- Run with only the Python standard library.
From a clone:
python -m pip install .Run without installing:
PYTHONPATH=src python -m iocraft --helpPowerShell:
$env:PYTHONPATH = "src"
python -m iocraft --helpExtract IOCs from a report:
iocraft extract examples/report.txtExport Markdown with defanged values:
iocraft extract examples/report.txt --format markdown --defang-outputExport JSON:
iocraft extract examples/report.txt --format json --output iocs.jsonOnly extract network indicators:
iocraft extract examples/report.txt --types ipv4,domain,urlDefang or refang text directly:
iocraft defang "https://evil.example/path"
iocraft refang "hxxps://evil[.]example/path"| Field | Meaning |
|---|---|
type |
IOC type: ipv4, domain, url, email, md5, sha1, or sha256 |
value |
Original extracted value |
normalized |
Refanged and normalized value |
safe |
Defanged value for sharing |
source |
Input file path |
line |
1-based line number |
tags |
Extra context such as public-ip, private-ip, or hash algorithm |
hxxps://login-update[.]example/collect
93.184.216.34
attacker@example.net
d41d8cd98f00b204e9800998ecf8427e
iocraft extract examples/report.txt --format tableRun tests:
python -m unittest discover -s testsRun a smoke check:
PYTHONPATH=src python -m iocraft extract examples/report.txt --format markdown --defang-outputIOCraft processes local text and writes local output. It does not call external services or need credentials. Treat extracted IOCs as potentially sensitive incident data.
See SECURITY.md.
MIT. See LICENSE.