{
  "slug": "ioc-extract",
  "name": "gizza-ai/ioc-extract",
  "version": "0.1.0",
  "title": "IOC Extractor — Pull IPs, URLs, Domains, Emails & Hashes from Text — gizza.ai",
  "description": "Extract IOCs from threat reports in your browser — IPs, URLs, domains, emails, MD5/SHA hashes — with defanged (hxxp, [.]) input support. Free, private, no sign-up.",
  "tags": [
    "ioc",
    "ioc extractor",
    "indicators of compromise",
    "extract ip",
    "extract url",
    "extract domain",
    "extract hash",
    "threat intelligence",
    "cti",
    "soc",
    "malware analysis",
    "defang",
    "ioc parser"
  ],
  "category": "security",
  "urls": {
    "page": "https://gizza.ai/tools/ioc-extract/",
    "markdown": "https://gizza.ai/tools/ioc-extract/index.md",
    "descriptor": "https://gizza.ai/tools/ioc-extract/tool.json",
    "deep_link_example": "https://gizza.ai/tools/ioc-extract/?text=Paste%20a%20log%20line%2C%20email%20or%20threat%20report%20%E2%80%94%20e.g.%20C2%20at%20hxxp%5B%3A%2F%2F%5Devil%5B.%5Dcom%20from%20203.0.113.5%2C%20hash%20d41d8cd98f00b204e9800998ecf8427e&types=all&defang=true"
  },
  "cli": "gizza tool ioc-extract \"Paste a log line, email or threat report — e.g. C2 at hxxp[://]evil[.]com from 203.0.113.5, hash d41d8cd98f00b204e9800998ecf8427e\"",
  "tool": {
    "description": "Extract indicators of compromise (IOCs) from an arbitrary block of text — IPv4/IPv6 addresses, URLs, domains, emails, and MD5/SHA-1/SHA-256/SHA-512 hashes — de-duplicated, sorted and grouped by type. Recognizes and refangs defanged input; can optionally re-defang the output.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "defang": {
          "default": false,
          "type": "boolean"
        },
        "text": {
          "type": "string"
        },
        "types": {
          "default": "all",
          "type": "string"
        }
      },
      "required": [
        "text"
      ],
      "type": "object"
    }
  }
}