16 IOC types
url, domain, ipv4, ipv6, email, md5, sha1, sha256, sha512, cve, attack, btc, eth, xmr, registry, filename (shortcuts: hash, ip, wallet).
GitHub Packages · MIT · Node ≥ 18
ioc-sentinel
Extract indicators of compromise from threat reports, logs, emails and binaries, then export them as CSV, STIX 2.1, JSON or SARIF.
IOC extractor for threat intel and incident response: pulls URLs, domains, IPv4/IPv6, emails, MD5/SHA1/SHA256/SHA512, CVEs, ATT&CK IDs, crypto wallets and registry keys from text, logs and reports, refangs defanged IOCs, filters noise and exports JSON, CSV, STIX 2.1 and SARIF. Zero deps.
1 Point the
@mrlouiswrightscope at GitHub Packages in.npmrc@mrlouiswright:registry=https://npm.pkg.github.com2 Install
npm i -D @mrlouiswright/ioc-sentinel
Installing from GitHub Packages needs a token
Published to GitHub Packages, not npmjs.com. GitHub Packages needs a GitHub token with read:packages to install, even for public packages: add //npm.pkg.github.com/:_authToken=${GITHUB_TOKEN} to .npmrc or run npm login --registry=https://npm.pkg.github.com.
$ npx ioc-sentinel report.txtioc-sentinel — 1 target(s) report.txt iocs: 6 url: 1 domain: 2 ipv4: 1 sha256: 1 email: 1 MEDIUM report.txt:2 SHA256: 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f [ioc-hash] MEDIUM report.txt:1 URL: hxxp[://]evil-update[.]com/payload[.]bin [ioc-url] LOW report.txt:1 Domain: evil-update[.]com [ioc-domain] LOW report.txt:3 Domain: login-micros0ft[.]net [ioc-domain] LOW report.txt:3 Email: phish[@]login-micros0ft[.]net [ioc-email] LOW report.txt:1 IPv4: 185[.]220[.]101[.]45 [ioc-ipv4] 2 medium, 4 low✔ Passing (fail-on: critical).
Why it exists
ioc-sentinel pulls IOCs out of any text: URLs, domains, IPv4/IPv6 addresses, email addresses, MD5/SHA1/SHA256/SHA512 hashes, CVE IDs, MITRE ATT&CK IDs, Bitcoin/Ethereum/Monero wallets, Windows registry keys and suspicious file names. It refangs defanged indicators (“hxxps://evil[.]com”, “user[@]domain(dot)ru”) before matching, removes the usual noise (private IPs, example.com, XML namespaces, setup.py-style file names) and can fail a pipeline when an IOC matches your watchlist.
CLI, library and GitHub Action. Node.js 18+, zero runtime dependencies. Binaries are never executed: printable ASCII and UTF-16LE strings are read statically.
Features
Refanging
hxxp, hXXps, fxp, [.], (.), {.}, [dot], \., [:], [://], [@], (at).
Noise reduction
domains are checked against the gTLD/ccTLD list. Names ending in file extensions (.exe, .py, .md, .zip...) count as file names unless the analyst defanged them. Private, loopback, CGNAT, documentation, multicast and reserved IPs are dropped unless you pass --include-private. Repetitive hashes (000…) are ignored, Ethereum addresses aren't mistaken for SHA1, and legacy Bitcoin addresses are Base58Check-validated. A built-in benign-domain list can be replaced (--benign) or disabled (--no-benign).
Watchlist
(-w known-bad.txt): one IOC per line, defanged values accepted, with an optional label after a space, tab or comma. Supports IPv4 CIDR ranges, parent domains (evil.com also matches cdn.evil.com and URLs on it) and URL prefixes. Hits produce watchlist-match (critical), so the default --fail-on critical fails only on known-bad indicators.
Inputs
files, whole directories (skips .git and node_modules), or stdin (-). Binary files are scanned via static string extraction.
Exports
--format csv|stix|list or --csv/--stix <file>, with --defang to make CSV/list output safe to paste. The STIX 2.1 bundle contains indicators with proper patterns ([file:hashes.'SHA-256' = '…']), plus vulnerability and attack-pattern objects for CVEs and ATT&CK IDs, using deterministic IDs. The JSON report has a deduplicated iocs array with counts and file:line sources.
Usage
# human-readable list, grouped by file
npx ioc-sentinel report.pdf.txt# Example
npx ioc-sentinel ./case-42/ --format csv --defang > iocs.csv# exit 1 on a watchlist hit
cat alert.eml | npx ioc-sentinel - -w known-bad.txt# Example
npx ioc-sentinel logs/ --types url,domain,ip --stix iocs.stix.json --sarif iocs.sarifCI / GitHub Action
permissions:
contents: read
security-events: write # only for the SARIF upload
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with: { persist-credentials: false }
- uses: MrLouisWright/ioc-sentinel@v1
with:
targets: 'reports/'
fail-on: critical
sarif: ioc-sentinel.sarif
- uses: github/codeql-action/upload-sarif@v3
if: always()
with: { sarif_file: ioc-sentinel.sarif }Options & flags
| Flag | Description |
|---|---|
| Extraction | |
-t, --types <list> | url, domain, ipv4, ipv6, email, md5, sha1, sha256, sha512, cve, attack, btc, eth, xmr, registry, filename (also: hash, ip, wallet). Default: all |
--include-private | Keep private/loopback/documentation IPs (dropped by default) |
--benign <list> | Domains to ignore (globs ok); replaces the built-in noise list |
--no-benign | Do not drop example.com, w3.org, schemas.microsoft.com etc. |
--no-refang | Do not refang hxxp://, [.] and friends before matching |
--no-binary | Skip binary files (default: extract printable strings statically) |
--file-name-domains | Treat names like "setup.py"/"invoice.zip" as domains too |
-w, --watchlist <file> | Known-bad IOCs (one per line; CIDR and *.domain ok). Hits are critical |
| Export | |
-f, --format <fmt> | text | json | sarif | markdown | csv | stix | list |
--defang | Defang values in csv/list output |
--csv <file> | Also write CSV; --stix <file> also write a STIX 2.1 bundle |
| Policy and output | |
-c, --config <file> | JSON config (default .ioc-sentinel.json if present) |
-f, --format <fmt> | text (default) | json | sarif | markdown |
--json/--sarif/--markdown <file> | Also write that format to a file |
--fail-on <sev> | critical | high | medium | low | info | none (default critical) |
--list-rules | Print rules and default severities |
--no-color | Disable colours |
Full reference, config file format and API in the README.
Support this project
Support open-source security tools
I build free, open-source tools that help developers ship safer websites. Every coffee helps keep them maintained, documented and free for everyone.
Buy me a coffee (opens Stripe in a new tab)Secure checkout by Stripe
More tools by Louis Wright
58 tools
Flagship Next.js 16 App Router libraries · pre-alpha · 2
- next-tonguePre-alphaCompiler-first, type-safe i18n for the Next.js 16 App Router.ICU messages compiled at build time, works with TurbopackLocale from route params, so pages stay in the static shellZero dependencies beyond next and react
- next-heraldPre-alphaTyped metadata, safe JSON-LD, sitemaps and an SEO CI check for the Next.js 16 App Router.Returns native Metadata, Sitemap and Robots objectsXSS-safe JSON-LD with an entity graph by defaultherald check: a dependency-free CI crawler for SEO mistakes
Sentinels security scanners & CI gates · 19
- binary-sentinelStatic PE and ELF triage in pure JavaScript: headers, sections, entropy, imports, imphash, packer hints, capabilities and hardening checks.
- cookie-sentinelAudit the cookies your site sets before attackers do.
- defang-sentinelDefang and refang indicators of compromise, and stop live malicious links from getting into threat reports, tickets and docs.
- dns-sentinelAudit your domains' DNS and email security before attackers or spammers find the gaps.
- dockerfile-sentinelSecurity linter for Dockerfiles and Docker Compose files: root containers, baked-in secrets, curl | sh, unpinned and end-of-life base images, privileged services, Docker socket mounts and exposed databases.
- dotenv-sentinelValidate .env files against .env.example or a schema, catch weak and default secrets, and keep .env files out of git, including its history.
- hash-sentinelCheck file hashes against your own threat feeds, MISP and optional public lookups, offline-first.
- header-sentinelFail CI when deployed URLs ship weak HTTP security headers.
- license-sentinelA license compliance gate for npm projects, plus CycloneDX/SPDX SBOMs and a NOTICES file.
- malware-report-sentinelTurn a suspicious file into a structured malware triage report (Markdown, HTML or JSON) using static analysis only.
- phish-sentinelOffline phishing URL heuristics with an explainable score: lookalike and homograph domains, brand impersonation, IP hosts, user@host tricks, risky TLDs, shorteners, free hosting and redirect chains.
- redirect-sentinelFind open redirects and mixed content in a built site (offline) or a live crawl: http:// scripts and styles on HTTPS pages, insecure forms, client-side redirects fed by the URL, open redirect rules in _redirects/vercel.json/nginx, HTTPS downgrades, and optional safe redirect probing.
- sbom-diff-sentinelSee exactly what a pull request changes in your software bill of materials, and block the risky changes.
- securitytxt-sentinelValidate security.txt (RFC 9116) and robots.txt for your domains, or as local files in CI before you deploy them.
- sri-sentinelSubresource Integrity for your built site: generate, write and check it in CI.
- static-link-sentinelFail CI on broken links before you deploy.
- supply-chain-sentinelOne supply-chain gate for npm projects: risky dependency changes, license policy, new vulnerabilities and SBOM drift, and GitHub Actions hardening, with one config, one report and one exit code.
- tls-sentinelCheck TLS endpoints for expiring or untrusted certificates, hostname mismatches, missing intermediates, weak keys and signatures, TLS 1.0/1.1, weak ciphers and missing TLS 1.3.
- workflow-sentinelCatch insecure GitHub Actions workflows before they're merged.
Gauges package & repo quality · 8
- commit-gaugeA lightweight Conventional Commits linter for git hooks and CI, with clear fix-up suggestions.
- dead-deps-gaugeFind dependencies you declare but never use, and imports that are missing from package.json.
- engines-gaugeMake engines.node, your CI matrix, .nvmrc and your dependencies' engine requirements agree.
- monorepo-gaugeHygiene checks for npm, yarn and pnpm workspaces: circular internal deps, mismatched shared deps, version drift and missing fields.
- pkg-field-gaugeValidate package.json before you publish: exports/main/types consistency, files, repository, keywords and sideEffects.
- publish-gaugeCheck what npm publish will actually ship, before you publish it.
- readme-gaugeLint READMEs for missing sections, broken badges, stale install commands and missing usage examples.
- semver-gaugeA CI gate that checks your version bump matches what changed, and that the CHANGELOG has a real entry for it.
Beacons SEO & discoverability · 9
- answer-beaconCheck that your built static site is ready for answer engines and AI search: direct answers, FAQ schema, llms.txt, AI crawler access and E-E-A-T signals.
- canonical-beaconCheck canonical tags and hreflang clusters in your built static site: one canonical per page, pointing at a real, indexable, final URL, and hreflang clusters that are valid, self-referencing and reciprocal.
- duplicate-beaconDetect duplicate and near-duplicate titles, meta descriptions and page bodies across your built static site.
- heading-beaconAudit the heading structure of your built static site: one visible H1 per page, a logical H1 → H2 → H3 outline, and headings that actually say something.
- index-beaconCheck which pages of your built static site search engines are told not to index or follow, via meta robots and X-Robots-Tag, against the rules you actually intend.
- meta-beaconAudit titles, meta descriptions, Open Graph and Twitter/X cards across a built static site.
- orphan-beaconFind the pages in your built static site that nothing links to, and measure how many clicks every page is from the homepage.
- schema-beaconValidate JSON-LD and microdata against schema.org and Google rich-result requirements, across your whole built site.
- sitemap-beaconAudit XML sitemaps against your built static site: every URL should be a real, indexable, canonical page, and every such page should be listed.
Wardens privacy, compliance & accessibility · 8
- a11y-wardenWCAG 2.2 accessibility audit of static HTML for CI, with a baseline so you can adopt it on an existing site and only fail on new problems.
- consent-wardenCheck that your cookie banner actually behaves: nothing non-essential loads before opt-in, Reject is as easy as Accept, and consent can be withdrawn.
- dsar-wardenAssemble Data Subject Access Request exports from many systems into one structured, checksummed bundle, and catch the mistakes before you send it.
- gpc-wardenCheck that your built site honours Global Privacy Control: it reads the signal and suppresses sale/share trackers when it is on.
- pii-log-wardenFind and redact personal data in log files: emails, phone numbers, IP addresses, card numbers and national IDs.
- policy-drift-wardenCompare the trackers and third parties your built site actually loads with what its privacy policy says, and fail CI when they drift apart.
- retention-wardenLint your data-retention policy as code: every data category gets a period, a legal basis and an action at expiry.
- tracker-wardenInventory every third-party tracker, pixel and SDK your built static site loads, with vendor, company and category, and gate CI on an approved-vendor list.
Pulses web performance · 8
- bundle-pulseA CI gate for JavaScript and CSS bundle size: budgets on raw, gzip and brotli sizes, and a diff against your base branch.
- cache-pulseCheck that your static hosting config caches the right things: fingerprinted assets for a year, HTML revalidated, and nothing stale after a deploy.
- font-pulseAudit how your built site loads web fonts: font-display, preloads, WOFF2, subsetting, unused weights and total font payload.
- image-pulseFind oversized, unoptimised and wrongly formatted images in your built site, before they slow down your Largest Contentful Paint.
- lazy-pulseLazy-load what is below the fold, never the LCP image: a static lazy-loading audit for your built site.
- render-pulseFind the CSS and JavaScript that block first paint in your built site, with the defer, async, media or critical-CSS fix for each.
- thirdparty-pulseHow much does each third-party script cost your pages? Estimated bytes, requests and main-thread time per page and per vendor, checked against budgets.
- vitals-pulseFail CI when Core Web Vitals get worse: LCP, CLS and an INP proxy, gated on thresholds and on regressions against your baseline.