Pull the indicators out of the noise, and package them PARCEL
The end of an investigation is a pile of indicators buried in notes and logs. This finds them, sorts them, drops the noise, defangs the dangerous ones, and writes them in a format another team can ingest.
The text
Paste a report, a log, notes, or SPECIMEN's output. Defanged indicators (hxxp, [.]) are understood.
Indicators
Untick anything benign before you export. Shown defanged; the STIX export keeps the real values.
How it works
What it does, and does not
It finds things shaped like indicators, dedupes them and drops private ranges and documentation domains; it does not judge whether each is malicious, so review before you share. Defanging keeps a malicious URL from going live in a ticket; the STIX bundle carries the real values for a platform to ingest. Everything stays in the browser. Pairs with SPECIMEN and MITRE.
Doing this often? The Sovereign Console pulls every indicator across a whole case into one place, and exports a self-contained report. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.