IOC Lens

approved

by acgabbert

Extracts and displays security-relevant indicators such as IP addresses, domains, and file hashes to enhance your cyber security note-taking process.

★ 24 stars↓ 1,108 downloadsUpdated 1mo agoGPL-3.0
Install in ObsidianView on GitHub

IOC Lens

IOC Lens is a note-taking helper for Obsidian focused on cyber security and incident response.

As security professionals, we encounter indicators of compromise (IOCs) constantly in our work. Whether you’re an incident responder, threat researcher, or SOC analyst, keeping track of these indicators within lengthy notes can be challenging. IOC Lens solves this by providing a dedicated Obsidian view that automatically extracts and organizes:

  • IP addresses (both public and private)
  • Domain names
  • SHA256 hashes
  • MD5 hashes

demo

To activate IOC Lens, click the ribbon icon or use the command palette.

ribbon icon

command palette

Key features:

  • Automatic IOC extraction from your notes
  • Defang domains and IP addresses via context menu options or command palette
  • Smart recognition of both standard and defanged IOCs (e.g. "evil[.]com")
  • One-click pivot buttons to search indicators across various security engines
  • Clean, organized view of all IOCs in your current note

Security considerations:

  • It's recommended to defang IOCs in your notes (e.g., using "evil[.]com" instead of "evil.com") to prevent accidental clicks or automated scanning
  • For compatibility with search engines, IOCs are automatically "refanged" in the sidebar view and when using the search pivot buttons
  • IOCs are displayed as plaintext in the sidebar - they are never clickable links
  • All interaction with IOCs is intentional and requires explicit user action

Privacy and network access

IOC Lens processes note contents locally and does not transmit note contents, indicators, or usage data. On startup, it requests the public top-level domain list from data.iana.org so that extracted domains can be validated. The list is cached in the plugin's Obsidian settings for offline use. If the request fails, IOC Lens continues to operate using the cached list when available and otherwise displays domain candidates without TLD validation.

Opening a search pivot is always an explicit user action. That action sends the selected indicator to the search provider named on the button, subject to that provider's own privacy policy.

Tips:

Per the guidance in Obsidian's Developer Documentation, a default hotkey has not been set for any IOC Lens functions. However, you can bind commands to hot keys via the Obsidian settings ("Hotkeys" section). Example: hotkey-example

This allows you to defang IOCs with a hotkey - for example, ⌘+⇧+A.

Supported Search Engines

IOC Lens currently supports pivots to the following resources/search engines. Pivots are configurable via toggle switches in the plugin settings.

Development

See CONTRIBUTING.md for local development and pull request guidance. Maintainers should follow RELEASING.md for the version, smoke-test, and publishing checklist.

For plugin developers

Search results and similarity scores are powered by semantic analysis of your plugin's README. If your plugin isn't appearing for searches you'd expect, try updating your README to clearly describe your plugin's purpose, features, and use cases.