Aggregate and deduplicate IOCs - IPs, domains, URLs, hashes - search across feeds, look up indicators via OTX and AbuseIPDB, and export CSV, JSON or STIX.
This aggregator collects indicators of compromise (IOCs) — IP addresses, domains, URLs, file hashes and email addresses — into one searchable workspace, removes duplicate indicators, and lets you organise them into collections and export them for an investigation. It is a defensive tool for blue teams, SOC analysts and incident responders who need to pull scattered threat data together, enrich a suspicious indicator, and hand a clean, deduplicated set to a SIEM, a firewall block list or a report. Everything is oriented around research and defence: looking indicators up, not attacking anything.
The daily problem in threat intelligence is fragmentation. Indicators arrive from many feeds in different formats, the same malicious IP shows up in five of them, and analysts waste time reconciling overlaps by hand. Aggregation and deduplication turn that noise into a single authoritative list you can act on.
It is important to be precise about where the data comes from. The tool maintains a catalog of well-known threat feeds — including AlienVault OTX, AbuseIPDB, abuse.ch URLhaus, Blocklist.de, SANS ISC and others — that it lists as available sources. For live indicator enrichment, when you look up a specific value, the tool queries AlienVault OTX and AbuseIPDB and merges their results with any indicators already stored. Some feeds in the catalog require your own API credentials to pull from, which is normal for threat intelligence — providers gate bulk access behind keys. Treat the catalog as the set of sources the tool knows about, and OTX plus AbuseIPDB as the ones consulted for on-demand lookups.
Different indicator types are actioned differently, and mixing them up weakens a response. IP addresses are the most volatile — attackers rotate them quickly, so an IP block is often short-lived. Domains are longer-lived and better for detection and sinkholing. URLs pinpoint a specific malicious page or payload location. File hashes (typically SHA-256) are the most durable and precise: a hash identifies an exact file regardless of where it is hosted, which is why hash-based blocking rarely produces false positives. Email addresses tie indicators to phishing and business-email-compromise campaigns. The aggregator detects and labels each type automatically so you can filter and export the right ones for each control.
Deduplication is not cosmetic. A block list with the same indicator repeated dozens of times wastes rule capacity and obscures how many distinct threats you actually face; merging duplicates while preserving the union of their sources gives you both a clean list and full provenance. Export format matters just as much: CSV suits spreadsheets and simple imports, JSON suits scripts and APIs, plain text suits quick block-list ingestion, and STIX is the structured standard that other threat-intelligence platforms understand, so it is the right choice when you are sharing indicators with partners or feeding a TIP. Choosing the format that matches the destination avoids lossy manual reformatting.
No. It is a defensive research tool. It aggregates, deduplicates, enriches and exports indicators of compromise so defenders can detect and block threats. It does not attack anything.
On-demand indicator lookups query AlienVault OTX and AbuseIPDB and merge their reputation data with stored indicators. The broader feed catalog lists additional well-known sources the tool knows about.
IP addresses, domains, URLs, file hashes and email addresses. Each is detected and labelled automatically so you can filter and export by type.
CSV, JSON, plain text and STIX. STIX is the structured standard for sharing indicators between threat-intelligence platforms.
Because the same IP, domain or hash appears across many feeds. Deduplication produces one authoritative entry per indicator — with sources merged — so block lists and detections are clean and accurate.
Some feeds in the catalog require your own provider credentials for bulk access, which is standard for threat intelligence. On-demand enrichment via the built-in providers does not require you to configure keys in the interface.
SHA-256 is the most reliable: it uniquely identifies a file regardless of where it is hosted, so hash-based detection rarely false-positives, unlike volatile IP indicators.
Aggregating indicators is only half the job; acting on them responsibly is the other half. Not every indicator in a feed deserves an automatic block. Feeds vary in quality, indicators age, and a shared hosting IP or a popular CDN domain can appear on a block list because one tenant misbehaved — blocking it outright can take down legitimate services. This is why the aggregator tracks severity and lets you filter on it, and why enrichment through OTX and AbuseIPDB matters: a second opinion on an indicator's reputation and recency helps you distinguish a high-confidence malicious host from stale or collateral data. A sensible workflow is to auto-block only high-confidence, durable indicators (such as known-bad file hashes), to review medium-confidence network indicators before enforcing them, and to treat single-source, low-severity entries as leads to investigate rather than facts to act on.
Provenance is part of that discipline. Because deduplication merges the sources of an indicator rather than discarding them, you can see how many independent feeds flagged a value — an indicator corroborated by several reputable sources is far more actionable than one that appears in a single low-quality list. Keeping that source information attached through export means the analyst on the receiving end can make the same judgement, rather than inheriting an opaque block list they cannot reason about.
Use the IOC extractor to pull indicators out of raw threat reports and logs before aggregating them, and the Nmap command builder when an investigation moves into authorised network verification.
Threat intelligence aggregation collects, normalizes, and correlates threat data from multiple sources — open-source feeds, commercial providers, government advisories, industry sharing groups (ISACs), and internal security tools — into a unified view of the threat landscape. Individual threat feeds provide fragments of the picture; aggregation assembles them into actionable intelligence.
Security teams are overwhelmed by the volume of threat data available. Thousands of indicators of compromise (IOCs), vulnerability advisories, and threat reports are published daily. Without aggregation and correlation, analysts cannot distinguish signal from noise or prioritize the threats most relevant to their organization.
| Source Type | Examples | Data Provided | Cost |
|---|---|---|---|
| Open-source feeds | AlienVault OTX, Abuse.ch, PhishTank | IOCs, malware hashes, phishing URLs | Free |
| Commercial feeds | Recorded Future, Mandiant, CrowdStrike | Curated intelligence, attribution, TTPs | $10K-$500K+/year |
| Government | CISA KEV, FBI Flash, NSA advisories | Vulnerability alerts, threat actor TTPs | Free |
| ISACs | FS-ISAC, H-ISAC, IT-ISAC | Industry-specific threats and indicators | Membership-based |
| Internal | SIEM alerts, incident data, honeypots | Organization-specific threat data | Existing infrastructure |
| Dark web | Monitoring services | Leaked credentials, planned attacks, exploit sales | Varies |
The tool supports five main IOC types: IP addresses, domain names, URLs, file hashes (including MD5, SHA-1, and SHA-256), and email addresses. Each IOC type is automatically detected when you add indicators manually or through bulk import.
The bulk import feature allows you to paste any text containing threat intelligence, such as security reports or IOC lists. The tool automatically extracts IP addresses, domains, URLs, hashes, and emails from the text using pattern matching, then adds them to your database with medium severity and manual-bulk source tagging.
You can export IOCs in four formats: CSV for spreadsheet analysis, JSON for programmatic use, plain text for simple lists, and STIX 2.1 for industry-standard threat intelligence sharing. STIX exports include TLP (Traffic Light Protocol) markings for data classification.
The confidence score (0-100%) indicates how reliable an IOC is based on its sources. Manually added IOCs receive 75% confidence by default, while bulk imports get 60%. IOCs from multiple sources receive higher confidence scores, and the score is automatically adjusted based on corroboration across different feeds.
Threat intelligence feeds are external sources that automatically provide updated IOC data. The Feed Management tab shows all configured feeds with their status, last update time, and IOC counts. You can add new feeds, trigger manual updates, and configure feed settings to customize data ingestion.
Yes, the Collections feature allows you to group IOCs by campaign, incident, or any custom criteria. Collections help organize your threat intelligence for specific investigations or use cases. Each collection tracks its IOC count and last update time, making it easy to manage multiple concurrent investigations.