IOC净化共享流水线
原名：building-ioc-defanging-and-sharing-pipeline
构建自动化管道，用于摄取原始 IOCs（URL、IP、域名等），实现威胁情报的高效收集与处理。
- 分类
- 开发提效
- 版本
- v1.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 2
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-08-24
- TRACE 评分
- 3.6 / 5
内容概览
IOC defanging modifies potentially malicious indicators (URLs, IP addresses, domains, email addresses) to prevent accidental clicks or execution while preserving readability for analysis and sharing. This skill covers building an automated pipeline that ingests raw IOCs from multiple sources, normalizes and deduplicates them, applies defanging for safe human consumption, converts them to STIX 2.1 format for machine consumption, and distributes through TAXII servers, MISP instances, and email reports. - When deploying or configuring building ioc defanging and sharing pipeline capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation - Python 3.9+ with defang, ioc-fanger, stix2, requests, validators librar…