[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESXC0DVRMH7PJ32RPDXC56":3,"skill-same:01M6ESXC0DVRMH7PJ32RPDXC56":103},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":14,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6ESXC0DVRMH7PJ32RPDXC56","building-ioc-defanging-and-sharing-pipeline",null,"Build an automated pipeline to defang indicators of compromise (URLs, IPs, domains, emails) for safe sharing and distribute them in STIX format through TAXII feeds and threat intelligence platforms.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fbuilding-ioc-defanging-and-sharing-pipeline\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"ioc","pipeline","defanging","building ioc defanging and sharing pipeline","sharing","domains","cybersecurity","de","id","emails","cm","t1566","indicators","ips","feeds","TAXII","stix","threat-intelligence","automation","threat intelligence","2026-11-10 10:12:30",false,"---\nname: building-ioc-defanging-and-sharing-pipeline\ndescription: Build an automated pipeline to defang indicators of compromise (URLs,\n  IPs, domains, emails) for safe sharing and distribute them in STIX format through\n  TAXII feeds and threat intelligence platforms.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- ioc\n- defanging\n- threat-sharing\n- stix\n- pipeline\n- indicator\n- automation\n- threat-intelligence\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1071.001\n- T1583.001\n- T1105\n- T1566.002\n---\n# Building IOC Defanging and Sharing Pipeline\n\n## Overview\n\nIOC defanging modifies potentially malicious indicators (URLs, IP addresses, domains, email addresses) to prevent accidental clicks or execution while preserving readability for analysis and sharing. This skill covers building an automated pipeline that ingests raw IOCs from multiple sources, normalizes and deduplicates them, applies defanging for safe human consumption, converts them to STIX 2.1 format for machine consumption, and distributes through TAXII servers, MISP instances, and email reports.\n\n\n## When to Use\n\n- When deploying or configuring building ioc defanging and sharing pipeline capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `defang`, `ioc-fanger`, `stix2`, `requests`, `validators` libraries\n- MISP instance or TAXII server for automated sharing\n- Understanding of IOC types: IPv4\u002FIPv6, domains, URLs, email addresses, file hashes\n- Familiarity with STIX 2.1 Indicator patterns and TLP marking definitions\n- Access to threat intelligence feeds for IOC ingestion\n\n## Key Concepts\n\n### IOC Defanging Standards\n\nDefanging replaces active protocol and domain components to prevent execution: `http:\u002F\u002F` becomes `hxxp:\u002F\u002F`, `https:\u002F\u002F` becomes `hxxps:\u002F\u002F`, dots in domains\u002FIPs become `[.]`, `@` in emails becomes `[@]`. This is critical for sharing IOCs in reports, emails, Slack channels, and paste sites where auto-linking could trigger network connections to malicious infrastructure.\n\n### IOC Normalization\n\nRaw IOCs from different sources come in inconsistent formats. Normalization involves converting to lowercase, removing trailing slashes and whitespace, extracting domains from URLs, resolving URL encoding, validating format correctness, and deduplicating across sources.\n\n### STIX 2.1 Indicator Patterns\n\nSTIX patterns express IOCs in a standardized format: `[ipv4-addr:value = '203.0.113.1']`, `[domain-name:value = 'malicious.example.com']`, `[url:value = 'http:\u002F\u002Fevil.com\u002Fpayload']`, `[file:hashes.'SHA-256' = 'abc123...']`. Each indicator includes valid_from, indicator_types, confidence, and optional TLP markings.\n\n## Workflow\n\n### Step 1: Build IOC Extraction and Normalization\n\n```python\nimport re\nimport hashlib\nfrom urllib.parse import urlparse, unquote\nfrom datetime import datetime\n\nclass IOCExtractor:\n    \"\"\"Extract and normalize IOCs from text.\"\"\"\n\n    PATTERNS = {\n        \"ipv4\": r'\\b(?:(?:25[0-5]|2[0-4]\\d|1\\d{2}|[1-9]?\\d)\\.){3}(?:25[0-5]|2[0-4]\\d|1\\d{2}|[1-9]?\\d)\\b',\n        \"domain\": r'\\b(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z]{2,}\\b',\n        \"url\": r'https?:\u002F\u002F[^\\s\u003C>\"{}|\\\\^`\\[\\]]+',\n        \"email\": r'\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b',\n        \"md5\": r'\\b[a-fA-F0-9]{32}\\b',\n        \"sha1\": r'\\b[a-fA-F0-9]{40}\\b',\n        \"sha256\": r'\\b[a-fA-F0-9]{64}\\b',\n    }\n\n    WHITELIST_DOMAINS = {\n        \"google.com\", \"microsoft.com\", \"amazon.com\", \"github.com\",\n        \"cloudflare.com\", \"akamai.com\", \"example.com\",\n    }\n\n    def extract_from_text(self, text):\n        \"\"\"Extract all IOC types from free text.\"\"\"\n        # Refang any already-defanged indicators first\n        text = self._refang(text)\n        iocs = {\"ipv4\": set(), \"domain\": set(), \"url\": set(),\n                \"email\": set(), \"md5\": set(), \"sha1\": set(), \"sha256\": set()}\n\n        for ioc_type, pattern in self.PATTERNS.items():\n            matches = re.findall(pattern, text)\n            for match in matches:\n                normalized = self._normalize(match, ioc_type)\n                if normalized and not self._is_whitelisted(normalized, ioc_type):\n                    iocs[ioc_type].add(normalized)\n\n        # Remove domains that are part of URLs\n        url_domains = set()\n        for url in iocs[\"url\"]:\n            parsed = urlparse(url)\n            url_domains.add(parsed.netloc)\n        iocs[\"domain\"] -= url_domains\n\n        total = sum(len(v) for v in iocs.values())\n        print(f\"[+] Extracted {total} unique IOCs from text\")\n        return {k: sorted(v) for k, v in iocs.items()}\n\n    def _refang(self, text):\n        \"\"\"Convert defanged indicators back to active form.\"\"\"\n        text = text.replace(\"hxxp:\u002F\u002F\", \"http:\u002F\u002F\").replace(\"hxxps:\u002F\u002F\", \"https:\u002F\u002F\")\n        text = text.replace(\"[.]\", \".\").replace(\"[@]\", \"@\")\n        text = text.replace(\"[:\u002F\u002F]\", \":\u002F\u002F\").replace(\"(.)\", \".\")\n        return text\n\n    def _normalize(self, value, ioc_type):\n        \"\"\"Normalize an IOC value.\"\"\"\n        value = value.strip().lower()\n        if ioc_type == \"url\":\n            value = unquote(value).rstrip(\"\u002F\")\n        elif ioc_type == \"domain\":\n            value = value.rstrip(\".\")\n        return value\n\n    def _is_whitelisted(self, value, ioc_type):\n        \"\"\"Check if IOC is in whitelist.\"\"\"\n        if ioc_type == \"domain\":\n            return value in self.WHITELIST_DOMAINS\n        if ioc_type == \"url\":\n            parsed = urlparse(value)\n            return parsed.netloc in self.WHITELIST_DOMAINS\n        return False\n\nextractor = IOCExtractor()\nsample_text = \"\"\"\nMalware C2: hxxps:\u002F\u002Fevil-domain[.]com\u002Fbeacon\nDrops payload from 192.168.1.100 and contacts 10[.]0[.]0[.]1\nSHA256: 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f\nPhishing email from attacker[@]phishing-domain[.]com\n\"\"\"\niocs = extractor.extract_from_text(sample_text)\n```\n\n### Step 2: Defanging Engine\n\n```python\nclass IOCDefanger:\n    \"\"\"Defang IOCs for safe sharing in reports and communications.\"\"\"\n\n    def defang_url(self, url):\n        return url.replace(\"http:\u002F\u002F\", \"hxxp:\u002F\u002F\").replace(\"https:\u002F\u002F\", \"hxxps:\u002F\u002F\").replace(\".\", \"[.]\")\n\n    def defang_domain(self, domain):\n        return domain.replace(\".\", \"[.]\")\n\n    def defang_ip(self, ip):\n        return ip.replace(\".\", \"[.]\")\n\n    def defang_email(self, email):\n        return email.replace(\"@\", \"[@]\").replace(\".\", \"[.]\")\n\n    def defang_all(self, iocs):\n        \"\"\"Defang all IOCs in a dictionary.\"\"\"\n        defanged = {}\n        for ioc_type, values in iocs.items():\n            if ioc_type == \"url\":\n                defanged[ioc_type] = [self.defang_url(v) for v in values]\n            elif ioc_type == \"domain\":\n                defanged[ioc_type] = [self.defang_domain(v) for v in values]\n            elif ioc_type == \"ipv4\":\n                defanged[ioc_type] = [self.defang_ip(v) for v in values]\n            elif ioc_type == \"email\":\n                defanged[ioc_type] = [self.defang_email(v) for v in values]\n            else:\n                defanged[ioc_type] = values  # Hashes don't need defanging\n        return defanged\n\n    def generate_sharing_report(self, iocs, defanged, report_name=\"IOC Report\"):\n        \"\"\"Generate a human-readable defanged IOC report.\"\"\"\n        report = f\"# {report_name}\\n\"\n        report += f\"Generated: {datetime.now().isoformat()}\\n\\n\"\n\n        for ioc_type in [\"url\", \"domain\", \"ipv4\", \"email\", \"sha256\", \"sha1\", \"md5\"]:\n            values = defanged.get(ioc_type, [])\n            if values:\n                report += f\"## {ioc_type.upper()} ({len(values)})\\n\"\n                for v in values:\n                    report += f\"- `{v}`\\n\"\n                report += \"\\n\"\n\n        return report\n\ndefanger = IOCDefanger()\ndefanged = defanger.defang_all(iocs)\nreport = defanger.generate_sharing_report(iocs, defanged, \"Malware Campaign IOCs\")\nprint(report)\n```\n\n### Step 3: Convert to STIX 2.1 Format\n\n```python\nfrom stix2 import Indicator, Bundle, TLP_WHITE, TLP_GREEN, TLP_AMBER\nfrom datetime import datetime\n\nclass STIXConverter:\n    \"\"\"Convert raw IOCs to STIX 2.1 Indicator objects.\"\"\"\n\n    TLP_MAP = {\"white\": TLP_WHITE, \"green\": TLP_GREEN, \"amber\": TLP_AMBER}\n\n    def iocs_to_stix(self, iocs, tlp=\"green\", confidence=75):\n        \"\"\"Convert IOC dictionary to STIX 2.1 bundle.\"\"\"\n        stix_objects = []\n        marking = self.TLP_MAP.get(tlp, TLP_GREEN)\n\n        for ip in iocs.get(\"ipv4\", []):\n            stix_objects.append(Indicator(\n                name=f\"Malicious IP: {ip}\",\n                pattern=f\"[ipv4-addr:value = '{ip}']\",\n                pattern_type=\"stix\",\n                valid_from=datetime.now(),\n                indicator_types=[\"malicious-activity\"],\n                confidence=confidence,\n                object_marking_refs=[marking],\n            ))\n\n        for domain in iocs.get(\"domain\", []):\n            stix_objects.append(Indicator(\n                name=f\"Malicious Domain: {domain}\",\n                pattern=f\"[domain-name:value = '{domain}']\",\n                pattern_type=\"stix\",\n                valid_from=datetime.now(),\n                indicator_types=[\"malicious-activity\"],\n                confidence=confidence,\n                object_marking_refs=[marking],\n            ))\n\n        for url in iocs.get(\"url\", []):\n            escaped = url.replace(\"'\", \"\\\\'\")\n            stix_objects.append(Indicator(\n                name=f\"Malicious URL: {url[:60]}\",\n                pattern=f\"[url:value = '{escaped}']\",\n                pattern_type=\"stix\",\n                valid_from=datetime.now(),\n                indicator_types=[\"malicious-activity\"],\n                confidence=confidence,\n                object_marking_refs=[marking],\n            ))\n\n        for sha256 in iocs.get(\"sha256\", []):\n            stix_objects.append(Indicator(\n                name=f\"Malicious File Hash: {sha256[:16]}...\",\n                pattern=f\"[file:hashes.'SHA-256' = '{sha256}']\",\n                pattern_type=\"stix\",\n                valid_from=datetime.now(),\n                indicator_types=[\"malicious-activity\"],\n                confidence=confidence,\n                object_marking_refs=[marking],\n            ))\n\n        bundle = Bundle(objects=stix_objects)\n        print(f\"[+] Created STIX bundle with {len(stix_objects)} indicators\")\n        return bundle\n\nconverter = STIXConverter()\nstix_bundle = converter.iocs_to_stix(iocs, tlp=\"amber\", confidence=80)\nwith open(\"iocs_stix_bundle.json\", \"w\") as f:\n    f.write(stix_bundle.serialize(pretty=True))\n```\n\n### Step 4: Distribute Through MISP and TAXII\n\n```python\nimport requests\nimport json\n\nclass IOCDistributor:\n    \"\"\"Distribute IOCs through various channels.\"\"\"\n\n    def push_to_misp(self, iocs, misp_url, misp_key, event_info):\n        \"\"\"Push IOCs to MISP as a new event.\"\"\"\n        headers = {\n            \"Authorization\": misp_key,\n            \"Content-Type\": \"application\u002Fjson\",\n            \"Accept\": \"application\u002Fjson\",\n        }\n        event = {\n            \"Event\": {\n                \"info\": event_info,\n                \"distribution\": \"1\",  # This community only\n                \"threat_level_id\": \"2\",  # Medium\n                \"analysis\": \"2\",  # Completed\n                \"Attribute\": [],\n            }\n        }\n\n        type_mapping = {\n            \"ipv4\": \"ip-dst\",\n            \"domain\": \"domain\",\n            \"url\": \"url\",\n            \"email\": \"email-src\",\n            \"md5\": \"md5\",\n            \"sha1\": \"sha1\",\n            \"sha256\": \"sha256\",\n        }\n\n        for ioc_type, values in iocs.items():\n            misp_type = type_mapping.get(ioc_type)\n            if misp_type:\n                for value in values:\n                    event[\"Event\"][\"Attribute\"].append({\n                        \"type\": misp_type,\n                        \"value\": value,\n                        \"category\": \"Network activity\" if ioc_type in (\"ipv4\", \"domain\", \"url\") else \"Payload delivery\",\n                        \"to_ids\": True,\n                    })\n\n        resp = requests.post(\n            f\"{misp_url}\u002Fevents\",\n            headers=headers,\n            json=event,\n            verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\",  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n        )\n        if resp.status_code == 200:\n            event_id = resp.json().get(\"Event\", {}).get(\"id\", \"\")\n            print(f\"[+] MISP event created: {event_id}\")\n            return event_id\n        else:\n            print(f\"[-] MISP error: {resp.status_code} - {resp.text[:200]}\")\n            return None\n\n    def push_to_taxii(self, stix_bundle, taxii_url, collection_id, username, password):\n        \"\"\"Push STIX bundle to TAXII 2.1 collection.\"\"\"\n        from taxii2client.v21 import Collection\n        collection = Collection(\n            f\"{taxii_url}\u002Fcollections\u002F{collection_id}\u002F\",\n            user=username, password=password,\n        )\n        response = collection.add_objects(stix_bundle.serialize())\n        print(f\"[+] TAXII: Published bundle, status: {response.status}\")\n        return response\n\ndistributor = IOCDistributor()\ndistributor.push_to_misp(\n    iocs,\n    misp_url=\"https:\u002F\u002Fmisp.organization.com\",\n    misp_key=\"YOUR_MISP_API_KEY\",\n    event_info=\"Malware Campaign IOCs - 2025\",\n)\n```\n\n## Validation Criteria\n\n- IOCs extracted correctly from free text with refanging support\n- Defanging produces safe, non-clickable indicators\n- STIX 2.1 bundle contains valid indicator patterns\n- IOCs distributed to MISP and TAXII successfully\n- Deduplication prevents duplicate indicators\n- Whitelisting prevents false positives on known-good domains\n\n## References\n\n- [CISA: Cybersecurity Automation and Threat Intelligence Sharing](https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fpublications\u002FOperational%20Value%20of%20IOCs_508c.pdf)\n- [Defang Python Library](https:\u002F\u002Fpypi.org\u002Fproject\u002Fdefang\u002F)\n- [ioc-fanger](https:\u002F\u002Fpypi.org\u002Fproject\u002Fioc-fanger\u002F)\n- [STIX 2.1 Indicator Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Fstix\u002Fv2.1\u002Fos\u002Fstix-v2.1-os.html)\n- [Grokipedia: Defanging](https:\u002F\u002Fgrokipedia.com\u002Fpage\u002Fdefanging)\n- [Hunt.io: Best IOC Feeds](https:\u002F\u002Fhunt.io\u002Fglossary\u002Fbest-ioc-feeds)\n","# Building IOC Defanging and Sharing Pipeline\n\n## Overview\n\nIOC defanging modifies potentially malicious indicators (URLs, IP addresses, domains, email addresses) to prevent accidental clicks or execution while preserving readability for analysis and sharing. This skill covers building an automated pipeline that ingests raw IOCs from multiple sources, normalizes and deduplicates them, applies defanging for safe human consumption, converts them to STIX 2.1 format for machine consumption, and distributes through TAXII servers, MISP instances, and email reports.\n\n\n## When to Use\n\n- When deploying or configuring building ioc defanging and sharing pipeline capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `defang`, `ioc-fanger`, `stix2`, `requests`, `validators` libraries\n- MISP instance or TAXII server for automated sharing\n- Understanding of IOC types: IPv4\u002FIPv6, domains, URLs, email addresses, file hashes\n- Familiarity with STIX 2.1 Indicator patterns and TLP marking definitions\n- Access to threat intelligence feeds for IOC ingestion\n\n## Key Concepts\n\n### IOC Defanging Standards\n\nDefanging replaces active protocol and domain components to prevent execution: `http:\u002F\u002F` becomes `hxxp:\u002F\u002F`, `https:\u002F\u002F` becomes `hxxps:\u002F\u002F`, dots in domains\u002FIPs become `[.]`, `@` in emails becomes `[@]`. This is critical for sharing IOCs in reports, emails, Slack channels, and paste sites where auto-linking could trigger network connections to malicious infrastructure.\n\n### IOC Normalization\n\nRaw IOCs from different sources come in inconsistent formats. Normalization involves converting to lowercase, removing trailing slashes and whitespace, extracting domains from URLs, resolving URL encoding, validating format correctness, and deduplicating across sources.\n\n### STIX 2.1 Indicator Patterns\n\nSTIX patterns express IOCs in a standardized format: `[ipv4-addr:value = '203.0.113.1']`, `[domain-name:value = 'malicious.example.com']`, `[url:value = 'http:\u002F\u002Fevil.com\u002Fpayload']`, `[file:hashes.'SHA-256' = 'abc123...']`. Each indicator includes valid_from, indicator_types, confidence, and optional TLP markings.\n\n## Workflow\n\n### Step 1: Build IOC Extraction and Normalization\n\n```python\nimport re\nimport hashlib\nfrom urllib.parse import urlparse, unquote\nfrom datetime import datetime\n\nclass IOCExtractor:\n    \"\"\"Extract and normalize IOCs from text.\"\"\"\n\n    PATTERNS = {\n        \"ipv4\": r'\\b(?:(?:25[0-5]|2[0-4]\\d|1\\d{2}|[1-9]?\\d)\\.){3}(?:25[0-5]|2[0-4]\\d|1\\d{2}|[1-9]?\\d)\\b',\n        \"domain\": r'\\b(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z]{2,}\\b',\n        \"url\": r'https?:\u002F\u002F[^\\s\u003C>\"{}|\\\\^`\\[\\]]+',\n        \"email\": r'\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b',\n        \"md5\": r'\\b[a-fA-F0-9]{32}\\b',\n        \"sha1\": r'\\b[a-fA-F0-9]{40}\\b',\n        \"sha256\": r'\\b[a-fA-F0-9]{64}\\b',\n    }\n\n    WHITELIST_DOMAINS = {\n        \"google.com\", \"microsoft.com\", \"amazon.com\", \"github.com\",\n        \"cloudflare.com\", \"akamai.com\", \"example.com\",\n    }\n\n    def extract_from_text(self, text):\n        \"\"\"Extract all IOC types from free text.\"\"\"\n        # Refang any already-defanged indicators first\n        text = self._refang(text)\n        iocs = {\"ipv4\": set(), \"domain\": set(), \"url\": set(),\n                \"email\": set(), \"md5\": set(), \"sha1\": set(), \"sha256\": set()}\n\n        for ioc_type, pattern in self.PATTERNS.items():\n            matches = re.findall(pattern, text)\n            for match in matches:\n                normalized = self._normalize(match, ioc_type)\n                if normalized and not self._is_whitelisted(normalized, ioc_type):\n                    iocs[ioc_type].add(normalized)\n\n        # Remove domains that are part of URLs\n        url_domains = set()\n        for url in iocs[\"url\"]:\n            parsed = urlparse(url)\n            url_domains.add(parsed.netloc)\n        iocs[\"domain\"] -= url_domains\n\n        total = sum(len(v) for v in iocs.values())\n        print(f\"[+] Extracted {total} unique IOCs from text\")\n        return {k: sorted(v) for k, v in iocs.items()}\n\n    def _refang(self, text):\n        \"\"\"Convert defanged indicators back to active form.\"\"\"\n        text = text.replace(\"hxxp:\u002F\u002F\", \"http:\u002F\u002F\").replace(\"hxxps:\u002F\u002F\", \"https:\u002F\u002F\")\n        text = text.replace(\"[.]\", \".\").replace(\"[@]\", \"@\")\n        text = text.replace(\"[:\u002F\u002F]\", \":\u002F\u002F\").replace(\"(.)\", \".\")\n        return text\n\n    def _normalize(self, value, ioc_type):\n        \"\"\"Normalize an IOC value.\"\"\"\n        value = value.strip().lower()\n        if ioc_type == \"url\":\n            value = unquote(value).rstrip(\"\u002F\")\n        elif ioc_type == \"domain\":\n            value = value.rstrip(\".\")\n        return value\n\n    def _is_whitelisted(self, value, ioc_type):\n        \"\"\"Check if IOC is in whitelist.\"\"\"\n        if ioc_type == \"domain\":\n            return value in self.WHITELIST_DOMAINS\n        if ioc_type == \"url\":\n            parsed = urlparse(value)\n            return parsed.netloc in self.WHITELIST_DOMAINS\n        return False\n\nextractor = IOCExtractor()\nsample_text = \"\"\"\nMalware C2: hxxps:\u002F\u002Fevil-domain[.]com\u002Fbeacon\nDrops payload from 192.168.1.100 and contacts 10[.]0[.]0[.]1\nSHA256: 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f\nPhishing email from attacker[@]phishing-domain[.]com\n\"\"\"\niocs = extractor.extract_from_text(sample_text)\n```\n\n### Step 2: Defanging Engine\n\n```python\nclass IOCDefanger:\n    \"\"\"Defang IOCs for safe sharing in reports and communications.\"\"\"\n\n    def defang_url(self, url):\n        return url.replace(\"http:\u002F\u002F\", \"hxxp:\u002F\u002F\").replace(\"https:\u002F\u002F\", \"hxxps:\u002F\u002F\").replace(\".\", \"[.]\")\n\n    def defang_domain(self, domain):\n        return domain.replace(\".\", \"[.]\")\n\n    def defang_ip(self, ip):\n        return ip.replace(\".\", \"[.]\")\n\n    def defang_email(self, email):\n        return email.replace(\"@\", \"[@]\").replace(\".\", \"[.]\")\n\n    def defang_all(self, iocs):\n        \"\"\"Defang all IOCs in a dictionary.\"\"\"\n        defanged = {}\n        for ioc_type, values in iocs.items():\n            if ioc_type == \"url\":\n                defanged[ioc_type] = [self.defang_url(v) for v in values]\n            elif ioc_type == \"domain\":\n                defanged[ioc_type] = [self.defang_domain(v) for v in values]\n            elif ioc_type == \"ipv4\":\n                defanged[ioc_type] = [self.defang_ip(v) for v in values]\n            elif ioc_type == \"email\":\n                defanged[ioc_type] = [self.defang_email(v) for v in values]\n            else:\n                defanged[ioc_type] = values  # Hashes don't need defanging\n        return defanged\n\n    def generate_sharing_report(self, iocs, defanged, report_name=\"IOC Report\"):\n        \"\"\"Generate a human-readable defanged IOC report.\"\"\"\n        report = f\"# {report_name}\\n\"\n        report += f\"Generated: {datetime.now().isoformat()}\\n\\n\"\n\n        for ioc_type in [\"url\", \"domain\", \"ipv4\", \"email\", \"sha256\", \"sha1\", \"md5\"]:\n            values = defanged.get(ioc_type, [])\n            if values:\n                report += f\"## {ioc_type.upper()} ({len(values)})\\n\"\n                for v in values:\n                    report += f\"- `{v}`\\n\"\n                report += \"\\n\"\n\n        return report\n\ndefanger = IOCDefanger()\ndefanged = defanger.defang_all(iocs)\nreport = defanger.generate_sharing_report(iocs, defanged, \"Malware Campaign IOCs\")\nprint(report)\n```\n\n### Step 3: Convert to STIX 2.1 Format\n\n```python\nfrom stix2 import Indicator, Bundle, TLP_WHITE, TLP_GREEN, TLP_AMBER\nfrom datetime import datetime\n\nclass STIXConverter:\n    \"\"\"Convert raw IOCs to STIX 2.1 Indicator objects.\"\"\"\n\n    TLP_MAP = {\"white\": TLP_WHITE, \"green\": TLP_GREEN, \"amber\": TLP_AMBER}\n\n    def iocs_to_stix(self, iocs, tlp=\"green\", confidence=75):\n        \"\"\"Convert IOC dictionary to STIX 2.1 bundle.\"\"\"\n        stix_objects = []\n        marking = self.TLP_MAP.get(tlp, TLP_GREEN)\n\n        for ip in iocs.get(\"ipv4\", []):\n            stix_objects.append(Indicator(\n                name=f\"Malicious IP: {ip}\",\n                pattern=f\"[ipv4-addr:value = '{ip}']\",\n                pattern_type=\"stix\",\n                valid_from=datetime.now(),\n                indicator_types=[\"malicious-activity\"],\n                confidence=confidence,\n                object_marking_refs=[marking],\n            ))\n\n        for domain in iocs.get(\"domain\", []):\n            stix_objects.append(Indicator(\n                name=f\"Malicious Domain: {domain}\",\n                pattern=f\"[domain-name:value = '{domain}']\",\n                pattern_type=\"stix\",\n                valid_from=datetime.now(),\n                indicator_types=[\"malicious-activity\"],\n                confidence=confidence,\n                object_marking_refs=[marking],\n            ))\n\n        for url in iocs.get(\"url\", []):\n            escaped = url.replace(\"'\", \"\\\\'\")\n            stix_objects.append(Indicator(\n                name=f\"Malicious URL: {url[:60]}\",\n                pattern=f\"[url:value = '{escaped}']\",\n                pattern_type=\"stix\",\n                valid_from=datetime.now(),\n                indicator_types=[\"malicious-activity\"],\n                confidence=confidence,\n                object_marking_refs=[marking],\n            ))\n\n        for sha256 in iocs.get(\"sha256\", []):\n            stix_objects.append(Indicator(\n                name=f\"Malicious File Hash: {sha256[:16]}...\",\n                pattern=f\"[file:hashes.'SHA-256' = '{sha256}']\",\n                pattern_type=\"stix\",\n                valid_from=datetime.now(),\n                indicator_types=[\"malicious-activity\"],\n                confidence=confidence,\n                object_marking_refs=[marking],\n            ))\n\n        bundle = Bundle(objects=stix_objects)\n        print(f\"[+] Created STIX bundle with {len(stix_objects)} indicators\")\n        return bundle\n\nconverter = STIXConverter()\nstix_bundle = converter.iocs_to_stix(iocs, tlp=\"amber\", confidence=80)\nwith open(\"iocs_stix_bundle.json\", \"w\") as f:\n    f.write(stix_bundle.serialize(pretty=True))\n```\n\n### Step 4: Distribute Through MISP and TAXII\n\n```python\nimport requests\nimport json\n\nclass IOCDistributor:\n    \"\"\"Distribute IOCs through various channels.\"\"\"\n\n    def push_to_misp(self, iocs, misp_url, misp_key, event_info):\n        \"\"\"Push IOCs to MISP as a new event.\"\"\"\n        headers = {\n            \"Authorization\": misp_key,\n            \"Content-Type\": \"application\u002Fjson\",\n            \"Accept\": \"application\u002Fjson\",\n        }\n        event = {\n            \"Event\": {\n                \"info\": event_info,\n                \"distribution\": \"1\",  # This community only\n                \"threat_level_id\": \"2\",  # Medium\n                \"analysis\": \"2\",  # Completed\n                \"Attribute\": [],\n            }\n        }\n\n        type_mapping = {\n            \"ipv4\": \"ip-dst\",\n            \"domain\": \"domain\",\n            \"url\": \"url\",\n            \"email\": \"email-src\",\n            \"md5\": \"md5\",\n            \"sha1\": \"sha1\",\n            \"sha256\": \"sha256\",\n        }\n\n        for ioc_type, values in iocs.items():\n            misp_type = type_mapping.get(ioc_type)\n            if misp_type:\n                for value in values:\n                    event[\"Event\"][\"Attribute\"].append({\n                        \"type\": misp_type,\n                        \"value\": value,\n                        \"category\": \"Network activity\" if ioc_type in (\"ipv4\", \"domain\", \"url\") else \"Payload delivery\",\n                        \"to_ids\": True,\n                    })\n\n        resp = requests.post(\n            f\"{misp_url}\u002Fevents\",\n            headers=headers,\n            json=event,\n            verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\",  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n        )\n        if resp.status_code == 200:\n            event_id = resp.json().get(\"Event\", {}).get(\"id\", \"\")\n            print(f\"[+] MISP event created: {event_id}\")\n            return event_id\n        else:\n            print(f\"[-] MISP error: {resp.status_code} - {resp.text[:200]}\")\n            return None\n\n    def push_to_taxii(self, stix_bundle, taxii_url, collection_id, username, password):\n        \"\"\"Push STIX bundle to TAXII 2.1 collection.\"\"\"\n        from taxii2client.v21 import Collection\n        collection = Collection(\n            f\"{taxii_url}\u002Fcollections\u002F{collection_id}\u002F\",\n            user=username, password=password,\n        )\n        response = collection.add_objects(stix_bundle.serialize())\n        print(f\"[+] TAXII: Published bundle, status: {response.status}\")\n        return response\n\ndistributor = IOCDistributor()\ndistributor.push_to_misp(\n    iocs,\n    misp_url=\"https:\u002F\u002Fmisp.organization.com\",\n    misp_key=\"YOUR_MISP_API_KEY\",\n    event_info=\"Malware Campaign IOCs - 2025\",\n)\n```\n\n## Validation Criteria\n\n- IOCs extracted correctly from free text with refanging support\n- Defanging produces safe, non-clickable indicators\n- STIX 2.1 bundle contains valid indicator patterns\n- IOCs distributed to MISP and TAXII successfully\n- Deduplication prevents duplicate indicators\n- Whitelisting prevents false positives on known-good domains\n\n## References\n\n- [CISA: Cybersecurity Automation and Threat Intelligence Sharing](https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fpublications\u002FOperational%20Value%20of%20IOCs_508c.pdf)\n- [Defang Python Library](https:\u002F\u002Fpypi.org\u002Fproject\u002Fdefang\u002F)\n- [ioc-fanger](https:\u002F\u002Fpypi.org\u002Fproject\u002Fioc-fanger\u002F)\n- [STIX 2.1 Indicator Specification](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Fstix\u002Fv2.1\u002Fos\u002Fstix-v2.1-os.html)\n- [Grokipedia: Defanging](https:\u002F\u002Fgrokipedia.com\u002Fpage\u002Fdefanging)\n- [Hunt.io: Best IOC Feeds](https:\u002F\u002Fhunt.io\u002Fglossary\u002Fbest-ioc-feeds)\n",{"name":5,"tags":49,"author":52,"domain":30,"license":15,"version":53,"nist_csf":54,"subdomain":41,"description":7,"mitre_attack":59},[24,26,50,40,25,51,42,41],"threat-sharing","indicator","mahipal","1.0",[55,56,57,58],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[60,61,62,63],"T1071.001","T1583.001","T1105","T1566.002","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fbuilding-ioc-defanging-and-sharing-pipeline","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill building-ioc-defanging-and-sharing-pipeline",{"tool":78,"command":79},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill building-ioc-defanging-and-sharing-pipeline",{"tool":81,"command":82},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill building-ioc-defanging-and-sharing-pipeline","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fbuilding-ioc-defanging-and-sharing-pipeline\u002FSKILL.md",true,[86,91,97],{"path":87,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fbuilding-ioc-defanging-and-sharing-pipeline\u002FLICENSE",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",1563,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fbuilding-ioc-defanging-and-sharing-pipeline\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",7028,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fbuilding-ioc-defanging-and-sharing-pipeline\u002Fscripts\u002Fagent.py",[104,145,154,163,185,211],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":125,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[111,114,117,120],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":121,"categoryName":122,"taxonomyType":123,"taxonomyTypeDesc":124},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[106,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":146,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":153,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[149,150,151,152],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":123,"taxonomyTypeDesc":124},[106,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144],{"skillNo":155,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":162,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[158,159,160,161],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":123,"taxonomyTypeDesc":124},[106,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144],{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[170,171,172,173,174,175,176,177,178,179,180,181,182,183,184],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":192,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[191],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[193,194,195,196,197,198,199,200,201,202,203,137,138,204,205,206,207,208,209,210],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":227,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[217,220,223,224],{"categoryNo":218,"categoryName":219,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":221,"categoryName":222,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":225,"categoryName":226,"taxonomyType":123,"taxonomyTypeDesc":124},"01JBSEEDCAT000000000000036","内容创作者",[228,229,230,231,232,233,234,235,134,236,137,138,139,237,238,239,240,241,184,242],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]