Skip to main content

API providing a limited CRUD for manipulating OpenIOC formatted Indicators of Compromise.

Project description


The source code in this package is made available under the terms of the Apache License , Version 2.0. See the “LICENSE “ file for more information.


  • Build Status
  • Coverage Status


William Gibb william.gibb at fireeye dot com


Provide a python library that allows for basic creation and editing of OpenIOC objects. It supports a basic CRUD (Create, Read, Update, Delete) for various items:

item Create Read Update Delete
IOC name Yes No Yes Yes
IOC description Yes No Yes Yes
created date Yes No Yes N/A
last modified date Yes No Yes N/A
published date Yes No Yes N/A
link metadata Yes No Yes Yes
IndicatorItem nodes Yes No NotYet Yes
Indicator nodes Yes No NotYet Yes
Parameters Yes No Yes Yes

Items do not have built in Read operations, since all items can be accesed with built in ElementTree syntax or the use of XPATH to select portions of the IOC.

No decision has been made about whether or not to support changing of existing Indicator/IndicatorItem nodes.

See the Docs located at and the examples directory for examples of working with the library. The user code should avoid having to call functionality in ioc_writer.ioc_et.


The python “lxml” library must be installed. This can be obtained from


See the file named “INSTALL” for instructions on installing this library locally.


Example code lives in the examples folder of the repository.

  1. examples/11_to_10_downgrade Script to downgrade OpenIOC 1.1 to OpenIOC 1.1.
  2. examples/openioc_to_yara Scripts that support encapsulating YARA signatures in OpenIOC 1.1 format.
  3. examples/simple_ioc_writer Script that consumes a csv of data to build an IOC. this csv contains the content, context, et cetera. An example CSV is provided.

Bug reports / questions / feedback / feature requests

william.gibb at fireeye dot com

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

ioc_writer-0.3.3.tar.gz (26.4 kB view hashes)

Uploaded source

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Huawei Huawei PSF Sponsor Microsoft Microsoft PSF Sponsor NVIDIA NVIDIA PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page