ioc-extraction

What problem does it solve?

This Skill automates the extraction, classification, and deduplication of Indicators of Compromise (IOCs) from various investigation artifacts, ensuring consistent and actionable threat intelligence.

Core Features & Use Cases

• Comprehensive Extraction: Identifies and extracts IP addresses, domain names, file hashes, URLs, email addresses, file paths, and registry keys.
• Intelligent Classification & Deduplication: Automatically classifies IOCs by type and removes duplicates, reducing noise.
• STIX 2.1 Mapping: Generates STIX 2.1 observable bundles for seamless integration with threat intelligence platforms and SIEMs.
• Use Case: Automatically scan log files and forensic reports to build a clean, categorized list of malicious IPs and domains for your security monitoring tools.

Quick Start

Extract all IOCs from the directory '/var/log/auth.log'.