IOC ExtractInstall

Summary

Extract IOCs from input text and output them either as a single item or as individual items, with optional refang/defang.

Inputs

• inputText (required) — The text from which to extract Indicators of Compromise
• outputMode — Choose how to output the extracted IOCs (single item or each IOC as separate item)
• refangInput — Whether to refang defanged IOCs in input text before extraction
• defangOutput — Whether to defang extracted IOCs in the output

Output shape

An array of workflow items; when outputMode is 'single' each item contains a json.iocs field with all extracted IOCs, when 'individual' each extracted IOC becomes a separate item with a type attribute.

The operation may emit multiple items per input; refangInput and defangOutput affect formatting of domains and URLs; errors are propagated as per n8n error handling.

Examples

Example 1: Extract IOCs from a log line and emit each as a separate item.

inputText = "malicious.com example[.]com 192.0.2.1", outputMode = individual, refangInput = true, defangOutput = false

Example 2: Extract IOCs and bundle them into a single output item.

inputText = "phishing@example.com 10.0.0.5", outputMode = single, refangInput = false, defangOutput = true

Example 3: Refang defanged IOCs before extraction and defang the results.

inputText = "bad[.]site.com", refangInput = true, defangOutput = true, outputMode = single