Parse STIX/TAXII, CSV, and JSON threat intelligence feeds. Normalize IOCs and export in standard formats.
Paste a threat intelligence feed - a STIX 2.x bundle, a TAXII collection response, a vendor CSV, or a JSON export - and this tool extracts the indicators of compromise it contains, maps them to standard types (IPv4, IPv6, domain, URL, email, MD5, SHA-1, SHA-256), removes duplicates, and exports the cleaned set as CSV or a fresh STIX bundle. Format detection is by content, not file extension. Everything runs locally in the browser, so the pasted feed is never uploaded. The surprise most users hit: parsing is not judging. The tool normalizes syntax and typing; it never tells you an IOC is malicious, live, or worth blocking.
A concrete input and expected output from the current implementation.
Input
value,type 203.0.113.5,ip example.com,domain d41d8cd98f00b204e9800998ecf8427e,md5 203.0.113.5,ipv4
Expected output
Input: CSV, 4 rows Unique IOCs: 3 Duplicate rows dropped: 1 value type 203.0.113.5 IPv4 address example.com domain d41d8cd98f00b204e9800998ecf8427e MD5 hash
Rows 1 and 4 hold the same address under different type labels ('ip' and 'ipv4'), so the parser merges them into one IPv4 IOC and 4 input rows become 3 unique IOCs. The 32-hex-character value is valid MD5 length, and 203.0.113.5 lies in the RFC 5737 documentation range, so it is a safe sample value rather than a real host.
It reads what you paste and decides the format: a JSON document with a bundle object and STIX 2.x object types, a TAXII collection response (itself a STIX JSON document), a CSV with a header row, or a plain JSON array of objects. Recognized column or field names map to IOC types; anything unrecognized is kept as-is rather than assumed away.
Values are canonicalized before deduplication: hex hashes and domains compare case-insensitively, and hash length decides the algorithm - 32 hex characters is MD5, 40 is SHA-1, 64 is SHA-256. The same address labeled 'ip' in one row and 'ipv4' in another becomes one IPv4 IOC. The deduplicated set is what gets exported, as CSV or as a STIX 2.1 bundle.
No. The parse happens entirely in your browser and nothing in the pasted feed is sent to a server. That matters for this tool precisely because indicators are often internal or sensitive. If your organization's policy forbids client-side handling of certain data regardless, treat the tool as you would any local processing utility.
TAXII 2.1 is an HTTPS protocol, so a pull needs a server that will answer the browser. The tool parses pasted content: paste the response body of a collection Get Objects call, which is a STIX bundle, or export from your TAXII client and paste that. Direct fetching only works where the server allows cross-origin browser requests.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.