ioc-extract
Installation
SKILL.md
What this skill does
Automatically extracts Indicators of Compromise (IOCs) from text, log files, or URLs. Identifies IP addresses, domains, URLs, email addresses, and file hashes (MD5/SHA1/SHA256), then outputs a structured, defanged IOC list for safe sharing.
When to use
- Identifying malicious infrastructure during incident response
- Extracting IOCs from threat intelligence reports or emails
- Collecting attacker indicators by analyzing log files
- Preparing an IOC list for ingestion into a SIEM or TIP
Prerequisites
- Python 3.6 or higher
- (optional) ioc-finder library:
pip install ioc-finder - Input source: pasted text, local file path, or URL