IOC Lens

approved

by Aaron Gabbert

Extracts and displays security-relevant indicators such as IP addresses, domains, and file hashes to enhance your cyber security note-taking process.

★ 24 stars↓ 796 downloadsUpdated 1y agoGPL-3.0
View on GitHub

IOC Lens

IOC Lens is a note-taking helper for Obsidian focused on cyber security and incident response.

As security professionals, we encounter indicators of compromise (IOCs) constantly in our work. Whether you’re an incident responder, threat researcher, or SOC analyst, keeping track of these indicators within lengthy notes can be challenging. IOC Lens solves this by providing a dedicated Obsidian view that automatically extracts and organizes:

  • IP addresses (both public and private)
  • Domain names
  • SHA256 hashes
  • MD5 hashes

demo

To activate IOC Lens, click the ribbon icon or use the command palette.

ribbon icon

command palette

Key features:

  • Automatic IOC extraction from your notes
  • Defang domains and IP addresses via context menu options or command palette
  • Smart recognition of both standard and defanged IOCs (e.g. "evil[.]com")
  • One-click pivot buttons to search indicators across various security engines
  • Clean, organized view of all IOCs in your current note

Security considerations:

  • It's recommended to defang IOCs in your notes (e.g., using "evil[.]com" instead of "evil.com") to prevent accidental clicks or automated scanning
  • For compatibility with search engines, IOCs are automatically "refanged" in the sidebar view and when using the search pivot buttons
  • IOCs are displayed as plaintext in the sidebar - they are never clickable links
  • All interaction with IOCs is intentional and requires explicit user action

Tips:

Per the guidance in Obsidian's Developer Documentation, a default hotkey has not been set for any IOC Lens functions. However, you can bind commands to hot keys via the Obsidian settings ("Hotkeys" section). Example: hotkey-example

This allows you to defang IOCs with a hotkey - for example, ⌘+⇧+A.

Supported Search Engines

IOC Lens currently supports pivots to the following resources/search engines. Pivots are configurable via toggle switches in the plugin settings.

For plugin developers

Search results and similarity scores are powered by semantic analysis of your plugin's README. If your plugin isn't appearing for searches you'd expect, try updating your README to clearly describe your plugin's purpose, features, and use cases.