IOC Parser & Defanging Engine
A browser-native threat intelligence utility that parses, deduplicates, and defangs Indicators of Compromise from unformatted text and logs.
The Problem
Security analysts constantly copy and paste raw incident notes, emails, and SIEM snippets containing URLs, IPs, and hashes. Manually extracting and defanging indicators for tickets and threat sharing is slow and error-prone.
Project Context
Designed and built a client-side parsing utility that extracts standardized IOC types and converts dangerous live links into safe defanged formats (e.g., hxxps[://]...).
System Architecture & Data Flow
100% browser-side JavaScript parsing with zero server transmission, guaranteeing complete data privacy for sensitive incident data.
Analyst pastes raw log data, email headers, or ticket notes into the input buffer.
Optimized regular expressions parse IPv4, IPv6, FQDNs, URLs, email addresses, CVE numbers, MD5, SHA-1, and SHA-256 hashes.
Deduplication and normalization filters remove duplicates and invalid checksum values.
Interactive defanging toggle converts live protocols and domains into inert representations.
Results exportable via one-click copy or formatted JSON/text download.
Technologies & Tools Used
Security Considerations
- •Client-only execution: Zero network requests are made when processing data. Sensitive indicators and confidential client hostnames never leave the browser memory.
- •Input sanitized against script execution within the DOM.
Implementation Notes
• Implemented boundary-safe regex patterns to avoid false positives on software version strings (e.g. v1.2.3.4 vs IPv4).
• Supported both standard defanging conventions (hxxp, [.] and [:]) for safe copy-pasting into chat and ticketing tools.
Engineering Challenges
Verified Results
- Available as an active tool on ianjob.com (/tools/ioc-extractor).
- Processes large 5,000-line log dumps in under 80 milliseconds in browser memory.
Lessons Learned
- •Privacy by design in security utilities builds immediate trust with analysts dealing with sensitive case materials.
- •Small, focused tools that solve a concrete workflow friction are often more valuable than oversized frameworks.