Pull the Indicators Out of the Noise, and Package Them PARCEL
The end of an investigation is a pile of indicators buried in notes and logs. This finds them, sorts them, drops the noise, defangs the dangerous ones, and writes them in a format another team can ingest.
The text
Paste a report, a log, notes, or SPECIMEN's output. Defanged indicators (hxxp, [.]) are understood.
Indicators
Untick anything benign before you export. Shown defanged; the STIX export keeps the real values.
What it does, and does not
It finds things shaped like indicators, dedupes them and drops private ranges and documentation domains; it does not judge whether each is malicious, so review before you share. Defanging keeps a malicious URL from going live in a ticket; the STIX bundle carries the real values for a platform to ingest. Everything stays in the browser. Pairs with SPECIMEN and MITRE.