IOC Lens
acgabbert1k downloadsExtracts and displays security-relevant indicators such as IP addresses, domains, and file hashes to enhance your cyber security note-taking process.
- Overview
- Scorecard
- Updates5
IOC Lens is a note-taking helper for Obsidian focused on cyber security and incident response.
As security professionals, we encounter indicators of compromise (IOCs) constantly in our work. Whether you’re an incident responder, threat researcher, or SOC analyst, keeping track of these indicators within lengthy notes can be challenging. IOC Lens solves this by providing a dedicated Obsidian view that automatically extracts and organizes:
- IP addresses (both public and private)
- Domain names
- SHA256 hashes
- MD5 hashes
To activate IOC Lens, click the ribbon icon or use the command palette.
Key features:
- Automatic IOC extraction from your notes
- Defang domains and IP addresses via context menu options or command palette
- Smart recognition of both standard and defanged IOCs (e.g. "evil[.]com")
- One-click pivot buttons to search indicators across various security engines
- Clean, organized view of all IOCs in your current note
Security considerations:
- It's recommended to defang IOCs in your notes (e.g., using "evil[.]com" instead of "evil.com") to prevent accidental clicks or automated scanning
- For compatibility with search engines, IOCs are automatically "refanged" in the sidebar view and when using the search pivot buttons
- IOCs are displayed as plaintext in the sidebar - they are never clickable links
- All interaction with IOCs is intentional and requires explicit user action
Privacy and network access
IOC Lens processes note contents locally and does not transmit note contents,
indicators, or usage data. On startup, it requests the public top-level domain
list from data.iana.org so that extracted domains can be validated. The list
is cached in the plugin's Obsidian settings for offline use. If the request
fails, IOC Lens continues to operate using the cached list when available and
otherwise displays domain candidates without TLD validation.
Opening a search pivot is always an explicit user action. That action sends the selected indicator to the search provider named on the button, subject to that provider's own privacy policy.
Tips:
Per the guidance in Obsidian's Developer Documentation, a default hotkey has not been set for any IOC Lens functions. However, you can bind commands to hot keys via the Obsidian settings ("Hotkeys" section). Example:
This allows you to defang IOCs with a hotkey - for example, ⌘+⇧+A.
Supported Search Engines
IOC Lens currently supports pivots to the following resources/search engines. Pivots are configurable via toggle switches in the plugin settings.
Development
See CONTRIBUTING.md for local development and pull request guidance. Maintainers should follow RELEASING.md for the version, smoke-test, and publishing checklist.