TI Console Autor: TI Analytics Extensions

TI Console turns any text you are handed — a vendor report, a log, an
.eml file, a HAR export, a PDF — into a working list of indicators, and
keeps the whole triage in one tab. Nothing leaves the machine unless you
click a link that opens a site.

What it does

• Extracts 21 indicator types: IPv4/IPv6, CIDR, domains, URLs, e-mail,
  MD5/SHA-1/SHA-256/SHA-512, CVE, ASN, registry keys, Windows paths,
  crypto wallets, onion addresses, Telegram channels, Discord invites,
  MITRE ATT&CK technique IDs.
• Understands defanged values automatically: hxxp://, 1.1.1[.]1,
  example(dot)com. A hash broken across two lines by a PDF is glued back
  together; page boilerplate is filtered out.
• Breaks an .eml down into the Received path, SPF/DKIM/DMARC
  discrepancies and attachment hashes. Parses a HAR export without
  touching response bodies, cookies or authorisation headers.
• Matches each indicator to 103 OSINT and threat-intel services in 9
  categories, each tagged with what it will see — public or limited —
  and what it costs: free, free account, paid.
• One list of checks, configured once. A single click opens the
  services on it that work with the indicator found — network services
  for an address, sandboxes for a hash — as background tabs, instead of
  a dozen tabs opened by hand.
• Keeps a case, maps it onto the MITRE ATT&CK matrix, exports a layer
  for ATT&CK Navigator, STIX bundles and tables, and writes a report
  skeleton and draft Sigma, Suricata and YARA rules.

Why it is built this way

The extension must never be the thing that leaks an indicator you were
trusted with. So there is no server, no account, no automatic
enrichment and no background traffic. A "client data" mode hides every
service that would publish what it is given, and address ranges marked
as your own through browser policy are never submitted anywhere without
an explicit confirmation.

Access to websites is not requested at install time. It is requested
when you press "Parse page", and you may refuse.

The interface is available in English and Russian.