Back to catalogue

IOC Defanger

Developer Official v1.0.1

Extracts indicators of compromise from raw text and neutralises them deterministically, so they are safe to share, then drafts an analyst note.

by skrptiq

security builtin threat-intel
workflow Updated 19 July 2026 3 nodes 1 download

Sign in to import this skrpt into your workspace.

Sign in
What's included 3 nodes
1 workflow 1 skill 1 prompt 2 built-ins
workflow (1)

IOC Defanger

Extract IOCs, defang them deterministically, and draft an analyst note.

skill (1)

Analyst Note

Drafts a short threat-analyst note from the defanged indicators.

prompt (1)

Analyst Note

Drafts an analyst note from defanged indicators.

Built-ins (2) deterministic · runs offline · no tokens

Regex extract

built-in · offline · 0 tokens

Pull every match of a regular expression out of the text.

Defang

built-in · offline · 0 tokens

Neutralise URLs, emails and IPs so they can't be clicked or auto-linked.

Requirements 1 service
Services
  • LLM Service
Security Passed
All checks passed v1.0.1 · scanner v3.3.0

Detected

  • Services: llm-service
  • Permissions:
  • Data Handling:
Version history 1 release
v1.0.1 latest 12 July 2026

GH#820 — migrate both builtin steps (extract-iocs, defang-iocs) to the node-less `local.builtin` shape (#802 D1b): `id`/`input`/`context`, no backing skill nodes/edges; the `defang` step now takes `input: {{steps.extract-iocs.output}}` (was a from_step binding); downstream ref `{{steps.Defang IOCs.output}}` → `{{steps.defang-iocs.output}}`. Deterministic output unchanged. contents skills 3→1.

More from Developer

View all →

Send feedback

Sign in to send feedback — it lets us follow up and keeps the tracker free of spam.