A simple tool to automate IOC (IP, URL, Hash) extraction from logs.
As a Blue Team student, I noticed that manual log analysis takes time and is repetitive.
For example, when an alert appears, you often need to copy IPs and check them manually on platforms like VirusTotal.
This project is my attempt to reduce that manual work and better understand how log analysis works in practice.
The project is split into two parts:
Python Engine
- Extracts IPs, URLs, and hashes from log files using regex
- Outputs results into JSON format
Java Interface (in progress)
- Displays extracted data in a simple table
- Helps to quickly see which entries might be suspicious
- Extract IP addresses from raw logs
- Extract bare domains without duplicating hosts already captured as URLs
- Normalize common defanged IOCs such as
hxxp://and[.] - Basic detection of URLs / strings
- JSON output for further processing
- Optional AbuseIPDB enrichment when an API key is configured
Install the optional Python dependencies when you want AbuseIPDB enrichment:
python3 -m pip install -r requirements.txtCreate a local .env file from the example and set your own key:
cp .env.example .envThe expected variable name is:
ABUSEIPDB_API_KEY=YOUR_API_KEY
The extractor can still parse local IOCs without this key; reputation fields will show that no API key is configured.
Run the Python parser against the sample log:
cd python-backend
python3 extractor.pyThe sample includes IPv4, IPv6, URL, domain, defanged URL/domain, MD5, and SHA256 indicators.
/python-backend – log parsing logic
/java-frontend – GUI (in progress)
/samples – test log files
- Create project structure and README
- Improve regex (IPv4 / IPv6)
- Connect to AbuseIPDB API
- Add simple risk scoring
- Build Java GUI
Tao(0xTaoZ) Cybersecurity student | Aspiring Blue Team