What are your favorite tools/methods to extract atomic indicators of compromise (hash, IP, domain, URL) from documents? Could be websites, PDFs (thanks CISA), or plain text with questionable formatting. I’ve written a few, and have tested LLMs for this. But I’m curious what you like, and if this is maybe an area IFIN could improve??
I haven’t seen any non-vendor specific tools for this. I’ve used Crowdstrike’s Intel extension for this purpose and Cisco’s extension (I forget its name) but that’s because I worked at organizations that had subscriptions to those vendors.
