Extract, normalize, and defang Indicators of Compromise (IOCs) from unstructured threat reports, email headers, malware analyses, or raw telemetry. Detect RFC 1918 private IPs and cloud metadata SSRF targets, launch 1-click VirusTotal/AbuseIPDB investigations, and export directly to STIX 2.1, Snort/Suricata, iptables, and CSV.
Select an authentic threat intelligence report or paste your own raw artifacts.
Export verified IOCs directly into SIEMs, Firewalls, IDS/IPS rules, or STIX 2.1 feeds.
{
"type": "bundle",
"id": "bundle--cd82f55f-ceb5-4bfe-bd64-7be8b7ea02ae",
"spec_version": "2.1",
"objects": [
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--f88f0143-f4fc-477e-a49e-9457edabb31f",
"created": "2026-10-19T01:43:06.666Z",
"modified": "2026-10-19T01:43:06.666Z",
"name": "CVE: CVE-2022-26923",
"pattern": "[vulnerability:name = 'CVE-2022-26923']",
"pattern_type": "stix",
"valid_from": "2026-10-19T01:43:06.666Z"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--a46d01c5-1eec-49cb-85cc-d7f28163d463",
"created": "2026-10-19T01:43:06.666Z",
"modified": "2026-10-19T01:43:06.666Z",
"name": "URL: https://telemetry-azure-sync.net/api/v2/beacon",
"pattern": "[url:value = 'https://telemetry-azure-sync.net/api/v2/beacon']",
"pattern_type": "stix",
"valid_from": "2026-10-19T01:43:06.666Z"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--acf632b3-47d0-4504-9940-c9d143653c77",
"created": "2026-10-19T01:43:06.666Z",
"modified": "2026-10-19T01:43:06.666Z",
"name": "EMAIL: [email protected]",
"pattern": "[email-addr:value = '[email protected]']",
"pattern_type": "stix",
"valid_from": "2026-10-19T01:43:06.666Z"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--078830b2-7ab3-436f-97f3-32c388c769b5",
"created": "2026-10-19T01:43:06.666Z",
"modified": "2026-10-19T01:43:06.666Z",
"name": "SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"pattern": "[file:hashes.'SHA-256' = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855']",
"pattern_type": "stix",
"valid_from": "2026-10-19T01:43:06.666Z"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--2b6ff74c-444c-4ca2-96c2-5ce7d0a99add",
"created": "2026-10-19T01:43:06.666Z",
"modified": "2026-10-19T01:43:06.666Z",
"name": "MD5: 44d88612fea8a8f36de82e1278abb02f",
"pattern": "[file:hashes.MD5 = '44d88612fea8a8f36de82e1278abb02f']",
"pattern_type": "stix",
"valid_from": "2026-10-19T01:43:06.666Z"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--af711b92-e237-4465-b8df-96f072da684a",
"created": "2026-10-19T01:43:06.666Z",
"modified": "2026-10-19T01:43:06.666Z",
"name": "IPV4: 185.220.101.5",
"pattern": "[ipv4-addr:value = '185.220.101.5']",
"pattern_type": "stix",
"valid_from": "2026-10-19T01:43:06.666Z"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--0af35966-4c83-42a6-a38f-b2e270254b6b",
"created": "2026-10-19T01:43:06.666Z",
"modified": "2026-10-19T01:43:06.666Z",
"name": "IPV4: 198.51.100.42",
"pattern": "[ipv4-addr:value = '198.51.100.42']",
"pattern_type": "stix",
"valid_from": "2026-10-19T01:43:06.666Z"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--1688517b-04c6-42fb-830a-e8a0df5b4cab",
"created": "2026-10-19T01:43:06.666Z",
"modified": "2026-10-19T01:43:06.666Z",
"name": "IPV4: 10.0.4.15",
"pattern": "[ipv4-addr:value = '10.0.4.15']",
"pattern_type": "stix",
"valid_from": "2026-10-19T01:43:06.666Z"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--b84a876d-4f16-4ae1-b7c2-cc210ead2116",
"created": "2026-10-19T01:43:06.666Z",
"modified": "2026-10-19T01:43:06.666Z",
"name": "IPV4: 192.168.1.100",
"pattern": "[ipv4-addr:value = '192.168.1.100']",
"pattern_type": "stix",
"valid_from": "2026-10-19T01:43:06.666Z"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--e495f64e-7cc5-4973-881f-dbd856e25977",
"created": "2026-10-19T01:43:06.666Z",
"modified": "2026-10-19T01:43:06.666Z",
"name": "IPV4: 169.254.169.254",
"pattern": "[ipv4-addr:value = '169.254.169.254']",
"pattern_type": "stix",
"valid_from": "2026-10-19T01:43:06.666Z"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--44ded316-7c4c-440d-94c9-dd63ba6d6237",
"created": "2026-10-19T01:43:06.666Z",
"modified": "2026-10-19T01:43:06.666Z",
"name": "DOMAIN: cdn-update-service.com",
"pattern": "[domain-name:value = 'cdn-update-service.com']",
"pattern_type": "stix",
"valid_from": "2026-10-19T01:43:06.666Z"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--7be39292-114d-435b-a86c-60831ff2896c",
"created": "2026-10-19T01:43:06.666Z",
"modified": "2026-10-19T01:43:06.666Z",
"name": "DOMAIN: telemetry-azure-sync.net",
"pattern": "[domain-name:value = 'telemetry-azure-sync.net']",
"pattern_type": "stix",
"valid_from": "2026-10-19T01:43:06.666Z"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--4b12e362-4bfa-4878-8231-50e09dce8b1b",
"created": "2026-10-19T01:43:06.666Z",
"modified": "2026-10-19T01:43:06.666Z",
"name": "DOMAIN: protonmail.com",
"pattern": "[domain-name:value = 'protonmail.com']",
"pattern_type": "stix",
"valid_from": "2026-10-19T01:43:06.666Z"
}
]
}Translate extracted threat indicators into Splunk SPL, Microsoft Sentinel KQL, and Elastic queries.
Calculate CISA BOD 22-01 & SOC 2 patch deadlines for CVEs identified in threat reports.
Draft incident war room communications and SEC/GDPR notifications for confirmed IOC breaches.