Metadata-Version: 2.5
Name: iocforge-cli
Version: 0.1.0
Summary: Offline threat indicator extraction, normalization and reporting
Author: Noir Stack LLC
License: Proprietary Software License — Free Use, No Modification
License-File: LICENSE
Keywords: dfir,ioc,osint,stix,threat-intelligence
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Topic :: Security
Requires-Python: >=3.10
Provides-Extra: dev
Requires-Dist: build>=1.2; extra == 'dev'
Requires-Dist: pytest>=8; extra == 'dev'
Requires-Dist: ruff>=0.6; extra == 'dev'
Description-Content-Type: text/markdown

# IOCForge

Offline threat indicator extraction and normalization for incident responders, threat-intelligence analysts, and OSINT workflows.

**Features:** extracts IPv4 addresses, domains, HTTP(S) URLs, MD5, SHA-1, and SHA-256 hashes; refangs common `hxxp`, `[.]`, `(.)`, and `[:]` notation; deduplicates; exports JSON, CSV, and basic STIX 2.1 Indicator bundles. Does **not** make network requests, scan hosts, or enrich indicators.

## Installation

Python 3.10+:

```bash
python -m pip install -e ".[dev]"
```

## Examples

```bash
iocforge extract report.txt
iocforge extract report.txt --format csv --output indicators.csv
iocforge extract report.txt --format stix --output indicators.stix.json
cat report.txt | iocforge extract - --include-private
python -m iocforge extract report.txt
```

## Library API

```python
from iocforge import extract, export_json
print(export_json(extract("Observed hxxps://bad[.]example/path and 8.8.8.8")))
```

## Development

```bash
python -m pytest -q
ruff check .
python -m build
```

## Security and limitations

- Only process reports you have permission to handle. Reports may contain sensitive URLs or identifiers; review output before sharing.
- No automatic threat verdict: a matched indicator is **not** proof of malicious activity.
- Domain parsing is heuristic (not Public Suffix List-aware). IPv6, emails, and nested URL artifacts are not supported in v0.1.0.
- URLs containing embedded credentials are skipped. URL fragments are removed.
- By default, non-global IPv4 addresses are excluded; `--include-private` includes them.
- STIX output is a minimal Indicator bundle, not a complete threat-intelligence knowledge model. Consumers should validate it against their own STIX tooling.
- Extracted indicators are never queried or contacted by IOCForge.

## Publishing

Choose an available PyPI distribution name (currently configured as `iocforge-cli`), update project metadata, and configure PyPI Trusted Publishing for your repository. The release workflow publishes only on GitHub Releases.

Copyright © 2026 Noir Stack LLC. Licensed under the
[Proprietary Software License — Free Use, No Modification](LICENSE).
