Extract, deduplicate, classify, and enrich IOCs from files, logs, memory dumps, PCAPs, and reports.
npx skills add https://github.com/Fuzzdkk/dfir-skills --skill ioc-extract-fuzzdkk
Please help me install this Agent Skill. Skill: ioc-extract Source: https://github.com/Fuzzdkk/dfir-skills/tree/main/ioc-extract Command: npx skills add https://github.com/Fuzzdkk/dfir-skills --skill ioc-extract-fuzzdkk
Addresses the need to quickly discover, deduplicate, and classify Indicators of Compromise across diverse evidence sources, enabling faster threat visibility and triage.
Run the IOC extractor on your evidence to produce structured IOC lists in Markdown, CSV, and JSON formats.
High-intent search queries and answers about installing and using this skill.
You can extract IOCs from logs and memory dumps by analyzing raw evidence with regex patterns to identify, deduplicate, and classify indicators of compromise. This process validates IPs, domains, and hashes to produce organized lists for rapid triage.
Deduplicating and normalizing IOC data from PCAP files involves running an extraction process that consolidates repeated indicators and normalizes formats. This reduces noise and produces structured outputs in Markdown, CSV, and JSON for SIEMs.
Yes, extracted IOCs can be output in JSON and CSV formats for SIEM ingestion. The extraction process analyzes files and reports to classify indicators, producing structured lists in Markdown, CSV, and JSON formats for analysts and threat hunting.
Yes, IOC extraction works with raw evidence like files and reports without prior formatting by using shell utilities and regex patterns to validate indicators. It ingests diverse sources including memory dumps and PCAPs to discover and classify threat data.
Regex-based IOC extraction accelerates threat visibility over manual hunting by quickly discovering, deduplicating, and classifying indicators across diverse evidence sources. It reduces noise through normalization and delivers structured data for faster triage.
FuzzdkkAggregates timestamps from disk images, memory dumps, logs, PCAPs, and reports into a unified forensic timeline.
dandyeEnrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.
refractionPOINTEvaluate threat reports to extract IOCs and behaviors across LimaCharlie organizations.
rjonhaasExtract static evidence and map malware capabilities to ATT&CK techniques.
