← All Tools
STIX 2.1 Indicator Formatter
Paste a flat list of IOCs — IPs, domains, URLs, file hashes, emails, CVE IDs — and turn them into a valid STIX 2.1 bundle for TAXII, MISP, OpenCTI, or threat-intel reports.
100% client-side. Indicators stay in your browser. Nothing is logged, sent, or analysed server-side.
Type is auto-detected. Optional inline override: 192.0.2.1 # ipv4 or foo.bar.com [type=domain].
Bundle metadata
STIX 2.1 bundle
Type detection rules
- ipv4-addr: dotted quad; ipv6-addr: colon-hex.
- domain-name: at least one dot, no scheme, no path.
- url: starts with
http://orhttps://. - file: 32 hex chars (MD5), 40 (SHA-1), 64 (SHA-256), 128 (SHA-512).
- email-addr: matches
local@domain. - vulnerability: matches
CVE-YYYY-NNNN+. - Defanged IOCs (
1.2.3[.]4,hxxp://...,foo[dot]bar) are refanged before detection.