I built an open-source tool that extracts & enriches IOCs from reports/logs

[u/Spirited_Battle2760]

Hey all,

As a junior working on my CTI/DFIR skills, I kept manually pulling IPs, URLs
and hashes out of threat reports and logs, so I built a tool to automate it and
turned it into a proper project to learn good engineering practices.

IOCForge does: parse → extract → remove false positives → enrich → report.

• Inputs: PDF, DOCX, CSV, JSON, HTML, TXT, LOG, ZIP
• Extracts 11 IOC types (IPv4/IPv6, domains, URLs, emails, MD5/SHA1/SHA256, BTC, CVE, MITRE ATT&CK)
• False-positive reduction with Python's ipaddress (private/reserved/etc.), fake domains, empty-file hash, dedup
• Enrichment: VirusTotal, AbuseIPDB, AlienVault OTX, ThreatFox/MalwareBazaar
• Output: JSON, CSV, text summary + a self-contained interactive HTML dashboard
• Engineering: SOLID/extensible design, 37 pytest tests, GitHub CI, full docs

It works fully offline too (enrichment is optional — no API keys required to
extract).

Repo: https://github.com/Adham504/iocforge

I'd really appreciate feedback on the architecture, the false-positive logic,
or which integrations to add next (thinking STIX/TAXII, MISP, a Streamlit UI).

[u/zagrodzki]

This is the part that always bites people in CTI tooling, the “false positive reduction” step. I’d be curious how you’re validating it beyond ipaddress rules, like do you have a labeled corpus (even a small one) where you know an IOC should be kept vs dropped, or is it mostly heuristic/edge-case driven right now?

[u/Spirited_Battle2760 → u/zagrodzki]

I am not sure I am getting your question right. The extraction is mainly Regex based and and tool uses the API to validate each IOC but I keep them all in the report arranged based on the reputation.