Your files stay on your device

# IOC to STIX converter

Turn a reviewed indicator list into a valid STIX 2.1 bundle with deterministic ids, patterns, and TLP markings.

Paste a reviewed indicator list, then press Build bundle.

The build maps each reviewed value to its STIX 2.1 observable: addresses and CIDR ranges, domains, URLs, email addresses, MD5, SHA-1, SHA-256 and SHA-512 hashes, file paths split into name and parent directory, registry keys with full hive names, and CVE ids, which become vulnerability objects because a CVE is not an observable. The finished bundle runs through the same validator a consumer would apply, and its findings show above the JSON. Nothing is uploaded and no feed is contacted; this tool shapes what you hand it, it does not judge whether an indicator is any good.
OptionsBuild bundle

## More regex & cron tools

- [UUID generator](/generate/uuid-generator)
- [Hash generator](/crypto/hash)
- [JSON validator](/json/validator)
[All regex & cron tools](/dev)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/dev/ioc-to-stix-converter
Markdown version: https://nutter.tools/dev/ioc-to-stix-converter.md
Plain-text version: https://nutter.tools/dev/ioc-to-stix-converter.txt
Agent index: https://nutter.tools/llms.txt