1.0 KiB
1.0 KiB
API Reference: Extracting IOCs from Analysis Output
Overview
scripts/analyst.py scans analysis text for URLs, domains, IPv4 addresses, emails, and hashes
using validated patterns, filters benign noise (RFC1918 IPs, well-known service domains), and
deduplicates. It reads a local text file only and performs no network activity.
Dependencies
| Package | Version | Purpose |
|---|---|---|
| (stdlib) | — | regex, JSON, file IO |
Core functions
extract(text)
Returns typed, deduplicated indicators and counts, with benign filtering applied.
_is_private(ip) / _benign_domain(d)
Noise filters for private address space and common service domains.
Usage
python scripts/analyst.py extract analysis.txt
Sources
- MITRE ATT&CK — https://attack.mitre.org/
- Indicator-extraction patterns (validated IPv4 octets, hash lengths) — https://github.com/InQuest/python-iocextract
- RFC1918 private address ranges for noise filtering — IETF RFC 1918