Your files stay on your device

IOC to STIX converter

Turn a reviewed indicator list into a valid STIX 2.1 bundle with deterministic ids, patterns, and TLP markings.

Paste a reviewed indicator list, then press Build bundle.

The build maps each reviewed value to its STIX 2.1 observable: addresses and CIDR ranges, domains, URLs, email addresses, MD5, SHA-1, SHA-256 and SHA-512 hashes, file paths split into name and parent directory, registry keys with full hive names, and CVE ids, which become vulnerability objects because a CVE is not an observable. The finished bundle runs through the same validator a consumer would apply, and its findings show above the JSON. Nothing is uploaded and no feed is contacted; this tool shapes what you hand it, it does not judge whether an indicator is any good.
OptionsBuild bundle

More regex & cron tools

- UUID generator (/generate/uuid-generator)
- Hash generator (/crypto/hash)
- JSON validator (/json/validator)
All regex & cron tools (/dev)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/dev/ioc-to-stix-converter
Markdown version: https://nutter.tools/dev/ioc-to-stix-converter.md
Plain-text version: https://nutter.tools/dev/ioc-to-stix-converter.txt
Agent index: https://nutter.tools/llms.txt