PackageTrack

PyPI

ioc-finder

9.4.1fhightower/ioc-finder ↗

Python package for finding and parsing indicators of compromise from text.

Release timeline

71 releases since 2018
20182026

One column per quarter.

Releases

  1. 9.4.117 Jun 2026
    Release notes

    Fixed

    • Fixed quadratic-time (ReDoS) behavior in the email-address candidate prefilter. The old (?:local+)@domain candidate regex restarted and re-walked the local part at every offset, so a long run of local-part characters (e.g. a base64/hex blob) caused find_iocs to hang — two 100 KB blobs took ~16 minutes each. The prefilter now anchors on @ and expands outward in linear time (_email_candidate_spans), with the domain tail matched by an anchored .match(); the pyparsing email grammar remains the precise validator and detection results are unchanged (#389).

    Changed

    • Bumped the ioc-fanger dependency floor to 5.1.1 (range >=5.1.1,<5.2).
    Open source →
  2. 9.4.015 Jun 2026
    Release notes

    Support unicode parsing

    Open source →
    Additional notes

    Added

    • Added a parse_unicode_iocs option to find_iocs (and a --parse_unicode_iocs CLI flag), default False (#298). When enabled, domain labels may contain non-ASCII (Unicode) characters — e.g. warrıors.com (note the dotless ı) is now parsed, as is the domain part of email, URL, and XMPP IOCs. The TLD itself stays ASCII (IANA stores internationalized TLDs in their xn-- punycode form), as do email/URL/XMPP local parts and URL paths. The ASCII and Unicode grammar variants are generated from a single builder (ioc_grammars._build_domain_layer) so they can't drift.
    Open source →
  3. 9.3.05 Jun 2026
    Release notes

    New ioc types, bug fixes, and performance improvements

    Open source →
    Additional notes

    Changed

    • Sped up domain name parsing by bypassing pyparsing for the standalone domain parser: candidate spans from the cheap regex are now validated against a TLD set directly, picking the rightmost TLD that leaves ≥1 preceding label. The domain_name grammar is still used as a sub-grammar inside email/url/xmpp parsers, where its inner label loop has been collapsed into a single Regex (replacing the OneOrMore(label + "." + FollowedBy(...)) construction).
    • The scheme_less_url and scheme_less_url_complete grammars no longer also match URLs with a scheme; they only match URLs without one (#244). parse_urls and parse_urls_complete now run the scheme-ful grammar first and mask each matched URL before running the scheme-less grammar, so user-facing output of find_iocs is unchanged but embedded scheme-less hosts inside a scheme-ful URL's query (e.g. https://shortener.com/?url=foo.com/bar) no longer surface as a second URL.

    Fixed

    • urls_complete now accepts @ in URL paths, matching the RFC 3986 pchar definition (e.g. https://example.com/users/@alice is now captured in full).
    • parse_user_agents no longer absorbs a trailing token like TLP from input such as Mozilla/4.0 (...) TLP:RED. A bare (version-less) platform token must not be immediately followed by :. Versioned platforms (e.g. Chrome/91.0) are unaffected. (#227)

    Added

    • New socket_addresses IOC type with a matching parse_socket_addresses helper (#248). Accepts ipv4:port and bracketed [ipv6]:port shapes with a 1..65535 port range. IPv6 host validation reuses the existing _is_valid_ipv6 helper so the same shortened forms accepted by parse_ipv6_addresses are accepted here too. Observed text is preserved verbatim (no leading-zero normalization). Port 0 is intentionally excluded as IANA-reserved.
    • New ipv6_cidrs IOC type with a matching parse_ipv6_cidrs helper (#121). It accepts the same shortened/::/trailing-:: forms as the existing IPv6 address parser plus a /0..128 bit range, and integrates with the existing CIDR-vs-URL and parse_address_from_cidr handling. CIDR parsing runs against the pre-fang text so the standard fanger (which rewrites ::/ to ://) cannot silently swallow indicators like 2001:db8::/32.
    • Added structured logging throughout the library using the standard logging module (#287). The package follows the standard library convention of attaching a NullHandler so consumers see no output unless they configure logging. find_iocs emits INFO at start/finish (text length, IOC type count), WARNING when unsupported types are passed via included_ioc_types (they are now ignored rather than silently treated as misses), and DEBUG for per-type result counts and lower-level transforms (text fanging, URL cleaning). Apps can opt in with e.g. logging.getLogger("ioc_finder").setLevel(logging.DEBUG).
    Open source →
  4. 9.2.01 May 2026
    Release notes

    Performance improvements on non-default ioc types

    Open source →
    Additional notes

    Added

    • Added regex prefiltering to all observable types (both default and non-default)

    Changed (Internal)

    • Switched fully over to UV.
      • Changed Dependabot to the uv ecosystem so pyproject.toml and uv.lock are updated atomically.
      • Removed the generated requirements.txt / requirements_dev.txt compatibility exports and the make export-requirements target. Contributors should use uv sync --locked --group dev to set up a dev environment.
    Open source →
  5. 9.1.129 Apr 2026
    Release notes

    Dedup imphashes and authentihashes

    Open source →
    Additional notes

    Fixed

    • parse_imphashes_ and parse_authentihashes_ no longer return the same hash multiple times when the input labels it with different separators (e.g. imphash: <h>, imphash <h>, imphash - <h>). The deduplication now runs on the extracted hash itself rather than the full keyword+separator+hash match string. (#213)
    Open source →
  6. 9.1.029 Apr 2026
    Release notes

    Performance improvements for default indicators

    Open source →
    Additional notes

    Added

    • Added regex pre-filter for all default indicator types to speed parsing of defaults.

    Fixed

    • IPv6 parser now accepts :: (the unspecified address) and trailing-:: forms (e.g. 1::), which were previously rejected by the grammar.
    Open source →
  7. 9.0.029 Apr 2026
    Release notes

    Focussing on major performance gains

    Open source →
    Additional notes

    Changed

    • Extended the regex pre-filter approach (introduced for the domain and ATT&CK parsers) to the remaining hot-path parsers. parse_complete_email_addresses, parse_email_addresses, parse_ipv6_addresses, parse_imphashes_, parse_authentihashes_, parse_urls, parse_urls_complete, parse_mac_addresses, parse_user_agents, and parse_file_paths now use cheap candidate regexes to narrow where the pyparsing grammar runs, dropping benchmark mean from ~7.1s to ~2.4s on the long benchmark article. The parse_domain_names and ATT&CK helpers were folded onto the same shared _scan_candidates helper (no behavior change).
    • Added scripts/find_hotspots.py to reproduce per-grammar timings and a cProfile drill-down for future tuning.
    • Breaking: DEFAULT_IOC_TYPES has been reduced from 30 entries to 9 common indicator types (domains, urls, ipv4s, ipv6s, email_addresses, md5s, sha1s, sha256s, cves) to speed up parsing in the typical case. Callers that relied on default-parsing of obscure types (e.g. bitcoin_addresses, attack_techniques, imphashes, urls_complete, etc.) must now pass included_ioc_types=SUPPORTED_IOC_TYPES (or an explicit subset) to get them. The CLI parses the common defaults by default; pass --all to parse every supported type. (#340)

    Added

    • New SUPPORTED_IOC_TYPES constant exposing the full list of parseable IOC types. Both DEFAULT_IOC_TYPES and SUPPORTED_IOC_TYPES are now exported from the ioc_finder package. (#340)
    • New --all CLI flag to parse every supported indicator type instead of the common defaults. (#340)

    Removed

    • Breaking: Removed the deprecated parse_imphashes and parse_authentihashes keyword arguments from find_iocs(), along with the --no_import_hashes and --no_authentihashes CLI flags. To disable parsing of these hash types, omit "imphashes" / "authentihashes" from included_ioc_types instead. (#333)
    Open source →
  8. 8.1.029 Apr 2026
    Release notes

    Performance improvements

    Open source →
    Additional notes

    Changed

    • The domain parser has been sped up with a regex pre-filter to identify possible candidate domains before using the grammar (#335)
    • The enterprise/mobile/pre-attack mitigation, tactic, and technique parsers now use a regex pre-filter to identify candidate ATT&CK-ID spans before running the grammar, significantly improving performance on large inputs (#238)
    Open source →
  9. 8.0.229 Apr 2026
    Release notes

    Deprecated

    • The parse_imphashes and parse_authentihashes keyword arguments to find_iocs(), and the corresponding --no_import_hashes / --no_authentihashes CLI flags, are now deprecated in favor of omitting "imphashes" / "authentihashes" from included_ioc_types. Passing these arguments emits a DeprecationWarning (CLI flags print a notice to stderr). They will be removed in a future release. (#225)

    Documentation

    • Documented known limitation where bitcoin address grammar may match file hashes (MD5s starting with 1/3, and MD5/SHA1/SHA256 hashes starting with bc1) (#226)
    Open source →
  10. 8.0.116 Mar 2026
    Release notes

    Changed

    • Migrated from pip/setuptools to uv for dependency management and packaging
    • Switched build backend from setuptools to hatchling
    • Replaced flake8, black, isort, and pylint with ruff for linting and formatting
    • Switched PyPI publishing to trusted publishing (OIDC) — no more username/password secrets
    • Updated Dockerfile base image from python:3.10.2-buster to python:3.14-slim-bookworm
    • Updated CI, Docker, Makefile, and docs to use uv throughout
    • Relaxed benchmark regression threshold from 10% to 15% to reduce flaky CI failures

    Removed

    • setup.py, setup.cfg, and mypy.ini (configuration consolidated into pyproject.toml)
    Open source →
  11. 7.3.022 Dec 2022
    Release notes

    Changed

    • To speed URL parsing, we no longer parse URLs with userinfo "@" in the authority (see URL syntax guide for more details)
      • Our reasoning is that userinfo is rarely present
      • If you have concerns about this change or would like to see it added back in (it could be optionally enabled), please raise an issue
    Open source →
  12. 7.2.425 Aug 2022
    Release notes

    Fixed

    • URL boundary to better respect the conventions of human language regarding quotation marks and parentheses (#130)
    Open source →
  13. 7.2.314 Jul 2022
    Release notes

    Fixed

    • Update required version of ioc-fanger which fixes issues with non-http(s) URL schemes (#255)
    Open source →
  14. 7.2.28 Jul 2022
    Release notes

    Fixed

    • Poorly designed grammars which were SIGNIFICANTLY slowing down this project (#250)
      • 🎉 This update improves mean run-times by ≈70%!
      • Thanks to @ptmcg for his contribution!
    Open source →
  15. 7.2.15 Jul 2022
    Release notes

    Fixed

    • Removed duplicative function calls
    Open source →
  16. 7.2.020 Jun 2022
    Release notes

    Changed

    • Possible breaking change: Update required pyparsing version to v3
      • Although there are no public API changes associated with this version, this may be a breaking change if you are using ioc-finder and have pyparsing pinned to a version less than v3
      • I've chosen to release this as a new minor version b/c I think requirement version updates w/ no API changes and no system requirement changes constitute a minor version change
    • Updated parsing of Google Analytics Tracker IDs so that matches must be all lower-cased or all upper-cased (e.g. ua-... and UA-... will be matched, but uA-... will not) (this makes the parsing consistent with how Google Adsense Publisher IDs are parsed)
    Open source →
  17. 7.1.013 Jun 2022
    Release notes

    Added

    • included_ioc_types option to only parse specified IOC types (#218)

    Changed

    • Imphashes are no longer parsed as md5s even when parse_imphashes is False (#231)
    • Authentihashes are no longer parsed as sha256s even when parse_authentihashes is False (#231)
    Open source →
  18. 7.0.027 May 2022
    Release notes

    Added

    • Support for Python 3.10 (#188)

    Removed

    • Phone number parsing (#155)
    • Support for Python 3.6 (#187)
    Open source →
  19. 6.0.19 Jun 2021
    Release notes

    Fixed

    • ASN grammar improved to reduce false positives by not matching on lower-case "as " (#136)
    Open source →
  20. 6.0.020 May 2021
    Release notes

    Changed

    • Made all boolean arguments keyword-only arguments (#108)
    • Converting data from lists to tuples (#110)
    • Made _prepare_text function public (prepare_text) (#114)
    • Renamed no_urls_without_schemes to parse_urls_without_scheme (#109)
    • Moved from MIT License to GNU Lesser General Public License v3.0 (#113)

    Fixed

    • Unquoting URLs appropriately (#104)
    • Pinned specific ioc-fanger version (this prevents an error where ioc-fanger was removing a URL in the query parameter of another URL - see #104)
    Open source →
  21. 5.0.39 Apr 2021
    Release notes

    Fixed

    • Unquoting URLs appropriately (#104)
    • Pinned specific ioc-fanger version (this prevents an error where ioc-fanger was removing a URL in the query parameter of another URL - see #104)
    Open source →
  22. 5.0.22 Apr 2021
    Release notes

    Changed

    Fixed

    • Updating library such that CIDR ranges are not detected as URLs when parse_urls_without_scheme=True (see #91)
    • Parse observables from URL path when parse_domain_from_url=False and parse_from_url_path=True (see #90)
    Open source →
  23. 5.0.111 Jan 2021
    Release notes

    Changed

    • Improved word boundary (specifically of MAC address and IP address grammars)
    Open source →
  24. 5.0.025 Sept 2020
    Release notes

    Removed

    • Concurrency (through the use of concurrent.futures)
    Open source →
  25. 4.0.323 Sept 2020

    Nothing published for this version

  26. 4.0.218 Sept 2020
    Release notes

    Added

    • Added parsing Monero addresses (see #94)

    Changed

    • Simplifying _remove_url_paths (a function used behind the scenes by the ioc finder - see #70)
    • Created a function to update top level domains (see #10)
    • Updating top level domains (which are used in grammars to find network observables)
    Open source →
  27. 4.0.111 Sept 2020
    Release notes

    Changed

    • You can now ingest text using the cli. For example, this now works: cat foo.text | ioc-finder.
    • We now have 100% code coverage!!!
    • Adding more keywords so this package is easier to find in pypi
    Open source →
  28. 4.0.09 Sept 2020
    Release notes

    Changed

    • We are now parsing observables from URL paths by default (see https://github.com/fhightower/ioc-finder/issues/87). If you would like to disable this functionality, you may do so by setting the parse_from_url_path keyword argument to False when calling the find_iocs function (e.g. parse_from_url_path=False).
    Open source →
  29. 3.1.227 Aug 2020
    Release notes

    The change log was added for version 3.1.2

    Open source →
  30. 3.1.13 Aug 2020

    Nothing published for this version

  31. 3.1.026 Jun 2020

    Nothing published for this version

  32. 3.0.013 Jun 2020

    Nothing published for this version

  33. 2.1.126 Feb 2020

    Nothing published for this version

  34. 2.1.011 Feb 2020

    Nothing published for this version

  35. 2.0.139 Jan 2020

    Nothing published for this version

  36. 2.0.122 Jan 2020

    Nothing published for this version

  37. 2.0.94 Dec 2019

    Nothing published for this version

  38. 2.0.822 Nov 2019

    Nothing published for this version

  39. 2.0.730 Oct 2019

    Nothing published for this version

  40. 2.0.69 Oct 2019

    Nothing published for this version

  41. 2.0.418 Sept 2019

    Nothing published for this version

  42. 2.0.311 Sept 2019

    Nothing published for this version

  43. 2.0.211 Sept 2019

    Nothing published for this version

  44. 2.0.14 Sept 2019

    Nothing published for this version

  45. 2.0.04 Jul 2019

    Nothing published for this version

  46. 1.2.187 Jun 2019

    Nothing published for this version

  47. 1.2.1624 Apr 2019

    Nothing published for this version

  48. 1.2.1518 Apr 2019

    Nothing published for this version

  49. 1.2.1412 Apr 2019

    Nothing published for this version

  50. 1.2.1312 Apr 2019

    Nothing published for this version

  51. 1.2.108 Apr 2019

    Nothing published for this version

  52. 1.2.85 Apr 2019

    Nothing published for this version

  53. 1.2.723 Mar 2019

    Nothing published for this version

  54. 1.2.613 Mar 2019

    Nothing published for this version

  55. 1.2.514 Feb 2019

    Nothing published for this version

  56. 1.2.48 Feb 2019

    Nothing published for this version

  57. 1.2.26 Feb 2019

    Nothing published for this version

  58. 1.2.123 Jan 2019

    Nothing published for this version

  59. 1.2.023 Jan 2019

    Nothing published for this version

  60. 1.1.019 Jan 2019

    Nothing published for this version