{
  "slug": "ioc-defang",
  "name": "gizza-ai/ioc-defang",
  "version": "0.1.0",
  "title": "Defang & Refang IOCs — Neutralize URLs, IPs, Domains & Emails — gizza.ai",
  "description": "Defang or refang IOCs in your browser: turn http://evil.com into hxxp[://]evil[.]com so URLs, IPs, domains and emails are safe to share. Free, private.",
  "tags": [
    "defang",
    "refang",
    "ioc",
    "indicators of compromise",
    "defang url",
    "defang ip",
    "threat intelligence",
    "cti",
    "soc",
    "malware analysis",
    "neutralize url",
    "hxxp"
  ],
  "category": "security",
  "urls": {
    "page": "https://gizza.ai/tools/ioc-defang/",
    "markdown": "https://gizza.ai/tools/ioc-defang/index.md",
    "descriptor": "https://gizza.ai/tools/ioc-defang/tool.json",
    "deep_link_example": "https://gizza.ai/tools/ioc-defang/?text=http%3A%2F%2Fevil.example.com%2Fpath%20or%20bad.actor%40evil.com&mode=defang&style=square"
  },
  "cli": "gizza tool ioc-defang \"http://evil.example.com/path or bad.actor@evil.com\"",
  "tool": {
    "description": "Defang or refang indicators of compromise (IOCs) in a block of text. Set mode to 'defang' (default) to neutralize URLs, IP addresses, domains and email addresses so they are safe to share in a report, ticket or email and won't auto-link or auto-execute — it rewrites 'http'/'https'/'ftp' to 'hxxp'/'hxxps'/'fxp', every '.' to '[.]', '@' to '[at]', and '://' to '[://]'. Set mode to 'refang' to do the inverse and restore a defanged blob back to the real, clickable indicator (it recognizes square [], round (), curly {} brackets plus the [dot]/[at] and meow:// conventions). The 'style' parameter picks the bracket style for defanging: 'square' (default, [.]), 'round' ((.)), 'curly' ({.}), or 'dot' (spelled out, [dot]). Surrounding prose is preserved; only the indicator characters are rewritten.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "mode": {
          "default": "defang",
          "description": "What to do. 'defang' (default) neutralizes IOCs so they are not clickable or auto-linked: 'http'/'https'/'ftp' -> 'hxxp'/'hxxps'/'fxp', every '.' -> '[.]', '@' -> '[at]', and '://' -> '[://]'. 'refang' is the inverse — restore a defanged blob to the real, clickable indicator (recognizes [], (), {} and [dot]/[at]/meow:// variants).",
          "enum": [
            "defang",
            "refang"
          ],
          "type": "string"
        },
        "style": {
          "default": "square",
          "description": "Bracket style used when defanging: 'square' (default) -> '[.]' '[at]' '[://]'; 'round' -> '(.)'; 'curly' -> '{.}'; 'dot' spells the separator -> '[dot]' '[at]'. Ignored when mode is 'refang' (all styles are recognized on the way back).",
          "enum": [
            "square",
            "round",
            "curly",
            "dot"
          ],
          "type": "string"
        },
        "text": {
          "description": "The text containing IOCs (URLs, IPs, domains, emails) to transform.",
          "type": "string"
        }
      },
      "required": [
        "text"
      ],
      "type": "object"
    }
  }
}