IOC Detector icon

IOC Detector

Extract and classify Indicators of Compromise (IOCs) from text data

IOC Detector

AI-generated

Summary

Extract IOCs from text input, classify IPs as internal/external, analyze domains for threat indicators, and attach structured IOC data to the workflow item.

Inputs

  • inputField (required) — With previous node: Enter field name (e.g., body) to analyze that field. Without previous node: Paste text directly here.

Output shape

Each processed item has json.iocs set to an object with ip_external, ip_internal, domain, and hash fields.

ip_external: Array of external IPv4 addresses (non-RFC1918). ip_internal: Array of private IPv4 addresses (10.x, 172.16-31.x, 192.168.x). domain: Object keyed by detected domain, each value {verdict, score, description} from DomainAnalyzer (CLEAN/SUSPICIOUS/MALICIOUS). hash: Array of normalized hash values (MD5/SHA1/SHA256/SHA512).

Links

Discussion