IOCForge

Offline threat indicator extraction and normalization for incident responders, threat-intelligence analysts, and OSINT workflows.

Features: extracts IPv4 addresses, domains, HTTP(S) URLs, MD5, SHA-1, and SHA-256 hashes; refangs common hxxp, [.], (.), and [:] notation; deduplicates; exports JSON, CSV, and basic STIX 2.1 Indicator bundles. Does not make network requests, scan hosts, or enrich indicators.

Installation

Python 3.10+:

python -m pip install -e ".[dev]"

Examples

iocforge extract report.txt
iocforge extract report.txt --format csv --output indicators.csv
iocforge extract report.txt --format stix --output indicators.stix.json
cat report.txt | iocforge extract - --include-private
python -m iocforge extract report.txt

Library API

from iocforge import extract, export_json
print(export_json(extract("Observed hxxps://bad[.]example/path and 8.8.8.8")))

Development

python -m pytest -q
ruff check .
python -m build

Security and limitations

• Only process reports you have permission to handle. Reports may contain sensitive URLs or identifiers; review output before sharing.
• No automatic threat verdict: a matched indicator is not proof of malicious activity.
• Domain parsing is heuristic (not Public Suffix List-aware). IPv6, emails, and nested URL artifacts are not supported in v0.1.0.
• URLs containing embedded credentials are skipped. URL fragments are removed.
• By default, non-global IPv4 addresses are excluded; --include-private includes them.
• STIX output is a minimal Indicator bundle, not a complete threat-intelligence knowledge model. Consumers should validate it against their own STIX tooling.
• Extracted indicators are never queried or contacted by IOCForge.

Publishing

Choose an available PyPI distribution name (currently configured as iocforge-cli), update project metadata, and configure PyPI Trusted Publishing for your repository. The release workflow publishes only on GitHub Releases.

Copyright © 2026 Noir Stack LLC. Licensed under the Proprietary Software License — Free Use, No Modification.