IOC Threat Intelligence Analyzer

A Python-based Indicator of Compromise (IOC) analysis and threat intelligence enrichment tool designed for initial security triage.

_{by: Brandon Chaney}

About the Project

When investigating a suspicious IP address, domain, URL, or file hash, one of the first steps is usually checking threat intelligence sources to see what is already known about it. Doing this manually across multiple platforms works, but it quickly becomes repetitive when analyzing more than a few indicators.

This Python tool is made to automate that process. The program first identifies the type of IOC being provided, then queries OSINT resources like VirusTotal and AlienVault OTX for available threat intelligence. It supports IPv4, IPv6, domains, URLs, MD5, SHA-1, and SHA-256 hashes.

Once the results are collected, the tool combines the available intelligence into a simple heuristic risk score, rating from 0–100 and assigns a severity rating (Low -> Critical). It also calculates a separate confidence level based on how many intelligence sources successfully returned information.

The goal of this tool isn't to determine with certainty whether an IOC is malicious, but to make the initial enrichment and triage process faster and easier to interpret. Threat intelligence can be incomplete, especially for new or uncommon indicators, so the results are intended to provide additional context rather than a final verdict.

The tool can analyze individual indicators or process a file containing multiple IOCs. Results can be viewed directly in the terminal or exported as JSON and CSV reports for additional analysis.

---

Table of Contents

• Overview
• Features
• Threat Intelligence Sources
• Risk Scoring
• Installation
• Usage
  • Batch Analysis
• Reporting
• Security Considerations
• Logging

---

Overview

Security analysts often need to investigate suspicious IP addresses, domains, URLs, and file hashes across multiple threat intelligence platforms.

IOC Analyzer automates this workflow:

IOC Input
    ↓
IOC Classification
    ↓
VirusTotal + AlienVault OTX
    ↓
Threat Intelligence Correlation
    ↓
Risk + Confidence Assessment
    ↓
Terminal / JSON / CSV Output

---

Features

• Automatic IOC classification
• IPv4 and IPv6 analysis
• Domain and URL analysis
• MD5, SHA-1, and SHA-256 analysis
• VirusTotal enrichment
• AlienVault OTX enrichment
• Heuristic risk scoring from 0–100
• LOW / MEDIUM / HIGH / CRITICAL classification
• Analysis confidence scoring
• Batch IOC processing
• Duplicate and invalid IOC handling
• JSON and CSV report generation
• API retry and rate-limit handling
• Logging
• Color-coded terminal output

---

Supported IOC Types

Type	Example
IPv4	8.8.8.8
IPv6	2001:4860:4860::8888
Domain	example.com
URL	https://example.com/path
MD5	32-character hash
SHA-1	40-character hash
SHA-256	64-character hash

---

Threat Intelligence Sources

VirusTotal

Retrieves:

• Malicious and suspicious detections
• Harmless and undetected counts
• Reputation
• Country information when available

AlienVault OTX

Retrieves:

• Threat pulse count
• Related pulse names
• Reputation
• Country information
• ASN information

---

Risk Scoring

IOC Analyzer uses a transparent heuristic scoring model.

Indicator	Score
VirusTotal malicious detection	+5 each, max 50
VirusTotal suspicious detection	+2 each, max 10
AlienVault OTX pulse	+5 each, max 40

The final score is capped at 100.

Score	Risk
0–29	LOW
30–59	MEDIUM
60–79	HIGH
80–100	CRITICAL

The tool also reports which indicators contributed to the score.

Confidence

Confidence is based on the number of threat intelligence sources that successfully returned data:

Sources	Confidence
2	HIGH
1	MEDIUM
0	LOW

Risk and confidence are kept separate so limited threat intelligence coverage is not mistaken for a benign result.

---

Installation

Clone the repository and install the required packages:

git clone <repository-url>
cd <repository-directory>

pip install requests python-dotenv colorama

Create a .env file:

VT_API_KEY=your_virustotal_api_key
OTX_API_KEY=your_alienvault_otx_api_key

At least one API key must be configured.

---

Usage

Analyze a single IOC:

python ioc_analyzer.py <ioc>

Batch Analysis

Create a text file containing one IOC per line:

8.8.8.8
example.com
https://example.com
44d88612fea8a8f36de82e1278abb02f

Run:

python ioc_analyzer.py --file iocs.txt

Blank lines, comments beginning with #, and duplicate indicators are automatically handled.

---

Reporting

Export JSON:

python ioc_analyzer.py example.com --json

Export CSV from a batch:

python ioc_analyzer.py --file iocs.txt --csv

Generate both:

python ioc_analyzer.py --file iocs.txt --json --csv -o investigation

Reports are stored in:

reports/

Batch analysis also provides:

• Total IOCs processed
• Invalid and duplicate counts
• Risk distribution
• Average risk score
• Highest-risk IOC

---

Security Considerations

IOC Analyzer is intended for threat intelligence enrichment and initial IOC triage.

A high score does not independently prove an IOC is malicious, and a low score does not guarantee it is benign. Results should be combined with additional evidence such as SIEM alerts, endpoint telemetry, network activity, DNS logs, and incident context.

The risk score is a custom heuristic and is not an industry-standard threat score.

---

Logging and Error Handling

Application activity is logged to:

logs/ioc_analyzer.log

The tool distinguishes between:

• Successful API responses
• No report found
• Rate limits
• Authentication errors
• Request failures
• Invalid API responses

Temporary request failures are retried using exponential backoff.