IOC to STIX Converter

Turn a reviewed indicator list into a valid STIX 2.1 bundle with proper identifiers, timestamps, patterns and labels, ready for a sharing platform.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

1 Paste indicators
2 Review each one
3 Describe the bundle
4 Validate and download

Indicators, one per line (defanged values are accepted)

From a list of strings to shareable intelligence

A spreadsheet of IP addresses is not threat intelligence a platform can ingest. STIX 2.1 Indicator objects are: each one has a machine-readable pattern, a validity window, a producer and, optionally, a confidence and a TLP marking. This tool builds those objects from the indicators you have reviewed and wraps them in a bundle. Before you can download the bundle, it runs through the same validator as the STIX 2.1 Validator.

How each type becomes a pattern

IP addresses use ipv4-addr:value or ipv6-addr:value. Ranges use ISSUBSET, so any address inside the range matches. Hashes use file:hashes with the algorithm names the specification defines, quoted where they contain a hyphen (file:hashes.'SHA-256'). Registry keys are written with the full hive name (HKEY_LOCAL_MACHINE, not HKLM) because that is what the windows-registry-key object stores. A file path becomes a file name plus its parent directory. A CVE becomes a Vulnerability object rather than an Indicator, because a CVE identifier is not something you observe on a network.

Escaping is where hand-written patterns fail

Pattern strings are single-quoted, and inside them only the backslash and the single quote are escaped. A Windows path contains backslashes, and a URL can contain an apostrophe. Both are escaped correctly here, and the parser confirms that every generated pattern parses.

Random or deterministic identifiers

By default every object gets a fresh random UUIDv4, which is what the specification expects of a new object. If you tick deterministic ids, indicators instead get a UUIDv5 derived from their pattern. That means publishing the same list again produces the same ids, so a consuming platform updates the objects rather than duplicating them. Use it only for your own feed: two unrelated producers using the same scheme would produce colliding identifiers by design.

Limitations

Values that STIX has no standard object for, such as a single-label hostname, are listed as skipped, not forced into an unsuitable object. Markings use the TLP 1.0 marking definitions predefined in STIX 2.1. TLP 2.0 is expressed through an extension, which this tool does not generate. Relationships to malware or campaigns are not created, because the list alone does not say what the indicators indicate.

Frequently asked questions

Why are some of my values unticked?

They were invalid or ambiguous. For example, invoice.exe could be a domain or a file name, and 010.0.0.1 reads differently in octal and decimal. Converting a guess into an indicator publishes the guess, so you have to confirm the type first.

Is anything sent to a server?

No. Normalising, building, validating and downloading all happen in your browser.

Can I convert text straight from a report?

Run it through the IOC Extractor first and export the actionable list. That step separates the attacker's infrastructure from the victim's network, documentation addresses and public resolvers.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.