stephenbrannon / IOCextractor

IOC (Indicator of Compromise) Extractor: a program to help extract IOCs from text files.
135 stars 39 forks source link

Updated IOCextractor to leverage python-cybox v2.0.0 #17

Closed bworrell closed 11 years ago

bworrell commented 11 years ago

I updated the IOCextractor to leverage python-cybox v2.0.0, which enables the output of CybOX v2.0 content. The output of CybOX 2.0 content is optional, following the conventions established for OpenIOC output. The following changes have been made:

I have tested this code out on Windows 7 64bit and OSX 10.8.4. Let me know if there are any issues and thank you for supporting the output of CybOX with the IOCextractor!

stephenbrannon commented 11 years ago

Looks great! I just tested it on Ubuntu 13.04, and it works there too. Thanks again for the support.

gtback commented 11 years ago

I also tested this on Ubuntu 12.04 and it looks good to me. The CybOX output is valid, and contains all the Observables I would expect.

I noticed that in TestDocument.txt, the full URL contains two IPs: 4.3.0.0 and 0.0.225.61, which probably aren't actually IPs, but I can understand why they were detected. It's a bit difficult in that you can't see when the same text is highlighted multiple times.