Skip to content

README.md

Latest commit

 

History

History
124 lines (87 loc) · 2.46 KB

README.md

File metadata and controls

124 lines (87 loc) · 2.46 KB
Raw

IOCraft

IOCraft is a small Python CLI for extracting, normalizing, defanging, and exporting indicators of compromise from reports, tickets, paste files, and plain logs.

It is built for analysts who want a quick, offline way to turn messy text into a clean IOC table.

Features

  • Extract IPv4 addresses, domains, URLs, email addresses, MD5, SHA1, and SHA256.
  • Refang common analyst-safe forms such as hxxp://evil[.]example.
  • Defang output for safe sharing.
  • Classify IPv4 addresses as public, private, loopback, multicast, reserved, or unspecified.
  • Output table, JSON, CSV, or Markdown.
  • Filter by IOC type.
  • Run with only the Python standard library.

Install

From a clone:

python -m pip install .

Run without installing:

PYTHONPATH=src python -m iocraft --help

PowerShell:

$env:PYTHONPATH = "src"
python -m iocraft --help

Quick Start

Extract IOCs from a report:

iocraft extract examples/report.txt

Export Markdown with defanged values:

iocraft extract examples/report.txt --format markdown --defang-output

Export JSON:

iocraft extract examples/report.txt --format json --output iocs.json

Only extract network indicators:

iocraft extract examples/report.txt --types ipv4,domain,url

Defang or refang text directly:

iocraft defang "https://evil.example/path"
iocraft refang "hxxps://evil[.]example/path"

Output Fields

Field Meaning
type IOC type: ipv4, domain, url, email, md5, sha1, or sha256
value Original extracted value
normalized Refanged and normalized value
safe Defanged value for sharing
source Input file path
line 1-based line number
tags Extra context such as public-ip, private-ip, or hash algorithm

Examples

hxxps://login-update[.]example/collect
93.184.216.34
attacker@example.net
d41d8cd98f00b204e9800998ecf8427e

iocraft extract examples/report.txt --format table

Development

Run tests:

python -m unittest discover -s tests

Run a smoke check:

PYTHONPATH=src python -m iocraft extract examples/report.txt --format markdown --defang-output

Security

IOCraft processes local text and writes local output. It does not call external services or need credentials. Treat extracted IOCs as potentially sensitive incident data.

See SECURITY.md.

License

MIT. See LICENSE.