IOC to STIX converter

The build maps each reviewed value to its STIX 2.1 observable: addresses and CIDR ranges, domains, URLs, email addresses, MD5, SHA-1, SHA-256 and SHA-512 hashes, file paths split into name and parent directory, registry keys with full hive names, and CVE ids, which become vulnerability objects because a CVE is not an observable. The finished bundle runs through the same validator a consumer would apply, and its findings show above the JSON. Nothing is uploaded and no feed is contacted; this tool shapes what you hand it, it does not judge whether an indicator is any good.