Python IOC Analyzer

Project Overview

This independent cybersecurity portfolio project demonstrates how Python can validate, classify, and summarize fictional Indicators of Compromise (IOCs).

The script reviews a mixed list of IP addresses, domains, URLs, and file hashes, identifies the IOC type, validates basic formatting, and generates an analyst-friendly report.

Skills Demonstrated

• Python
• Threat intelligence fundamentals
• Indicator of Compromise (IOC) analysis
• Regular expressions
• IP address validation
• URL and domain parsing
• Hash-format identification
• Security automation
• Analyst reporting

Project Files

• ioc_analyzer.py — Main Python analysis script
• sample_iocs.txt — Fictional indicators used for demonstration
• ioc_report.txt — Example report
• requirements.txt — Dependency notes

IOC Types Reviewed

• IPv4 addresses
• Domains
• URLs
• MD5 hashes
• SHA-1 hashes
• SHA-256 hashes

Run the Project

python3 ioc_analyzer.py

Cybersecurity Relevance

Security analysts frequently work with indicators such as IP addresses, domains, URLs, and file hashes during investigations and threat-intelligence reviews. Automating basic validation and classification can help analysts organize evidence and prioritize additional research.

Portfolio Note

This is an independent cybersecurity portfolio project created for educational and professional demonstration. All indicators are fictional or reserved examples and are not intended to represent active malicious infrastructure.

Future Improvements

• Reputation lookups through approved APIs
• IOC deduplication
• CSV and JSON export
• Confidence scoring
• Tagging by threat category
• STIX/TAXII formatting