How nagasivagunturu/ioc-insight works
IOC Insight is a command-line threat-intelligence assessment tool: an analyst supplies an IOC and type, the application queries applicable providers, converts their responses into a common representation, consolidates findings and failures, scores and classifies the result, then renders an explainable report. The README documents the provider coverage and assessment features; sampled entry-point and module code confirms the central orchestration and analysis calls. DataLoader and the AbuseIPDB/ThreatFox processors are indexed but not excerpted, so their internal call relationships are left unverified where necessary.
Main entry points: main.py CLI workflow · data_loader.py Response loading · intel.py Provider intelligence · otx_client.py OTX client
Components 21
Input and configuration
- CLI workflow
main.py - IOC value
models/ioc.py - IOC validation
utils/ioc_validator.py - API configuration
config/config_loader.py
Provider collection
- Response loading
utils/data_loader.py - OTX client
clients/otx_client.py - ThreatFox client
clients/threatfox_client.py - AbuseIPDB client
clients/abuseipdb_client.py - OTX normalization
processors/otx_processor.py - ThreatFox normalization
processors/threatfox_processor.py - AbuseIPDB normalization
processors/abuseipdb_processor.py
Intelligence analysis
- Provider intelligence
models/intel.py - Intel aggregation
aggregator/intel_aggregator.py - Consolidated findings
models/consolidated_intel.py - Scoring and analysis
analyzers/intel_analyzer.py - Assessment model
models/intelligence_assessment.py
Assessment output
- Report renderer
renderers/assessment_renderer.py
Other components
- Analyst
- AlienVault OTX
- ThreatFox API
- AbuseIPDB API
Connections 27
- Analyst → CLI workflow: provides IOC
README.md - CLI workflow → IOC validation: validates input
main.py - CLI workflow → IOC value: creates IOC
main.py - CLI workflow → Response loading: loads responses
main.py - Response loading → OTX client: invokes lookup
- Response loading → ThreatFox client: invokes lookup
- Response loading → AbuseIPDB client: invokes lookup
- OTX client → API configuration: gets API key
clients/otx_client.py - ThreatFox client → API configuration: gets API key
clients/threatfox_client.py - AbuseIPDB client → API configuration: gets API key
clients/abuseipdb_client.py - OTX client → AlienVault OTX: queries
clients/otx_client.py - ThreatFox client → ThreatFox API: queries
clients/threatfox_client.py - AbuseIPDB client → AbuseIPDB API: queries
clients/abuseipdb_client.py - CLI workflow → OTX normalization: processes response
main.py - CLI workflow → ThreatFox normalization: processes response
main.py - CLI workflow → AbuseIPDB normalization: processes response
main.py - OTX normalization → Provider intelligence: creates intelligence
processors/otx_processor.py - ThreatFox normalization → Provider intelligence: creates intelligence
processors/threatfox_processor.py - AbuseIPDB normalization → Provider intelligence: creates intelligence
README.md - CLI workflow → Intel aggregation: aggregates results
main.py - Intel aggregation → Provider intelligence: merges records
aggregator/intel_aggregator.py - Intel aggregation → Consolidated findings: produces findings
aggregator/intel_aggregator.py - CLI workflow → Scoring and analysis: analyzes findings
main.py - Scoring and analysis → Consolidated findings: reads findings
analyzers/intel_analyzer.py - Scoring and analysis → Assessment model: creates assessment
analyzers/intel_analyzer.py - CLI workflow → Report renderer: renders assessment
main.py - Report renderer → Assessment model: displays fields
renderers/assessment_renderer.py