Skip to main content

How to Generate IOC Queries

S
Written by Sergey Bayrachny

Operationalize Threat Intelligence by extracting Indicators of Compromise (IOCs) and applying them in practice to support the threat hunting process and complement behavior-based detections. Uncoder AI automatically identifies IOCs in the pasted text or uploaded file and packs them into queries based on your preferences. This feature does not rely on AI and runs exclusively on the Uncoder conversion engine.

  1. Go to the Generate mode in Uncoder AI.

  2. Select Threat Report/IOCs as the input type.

  3. Select IOC Query as the output.

  4. Select the platform (language) of the output query (start typing the platform name in the dropdown to filter the options).

  5. Paste the threat report text with IOCs or upload it from a file in CSV, JSON, or TXT format. Uncoder AI automatically identifies any IOCs in the input and highlights them with respective colors depending on their type. Note:

    1. Up to 10,000 IOCs can be packed into queries in one go.

    2. You can check the count of each iOC type at the bottom of the input panel.IOCs from the input are deduplicated.

  6. Optionally, click the Settings icon to change additional parsing settings that are all enabled by default:

    • Select all — all listed options are applied

    • Replace (.) [.] {.} with dot

    • Replace hxxp with http — this functionality is case insensitive, so hXXp, HXXP, HXXp, and hXXP are replaced as well

    • Exclude Private & Reserved Networks — private and reserved IP addresses like 224.0.0.0/4 or 127.0.0.0/8 are ignored during IOC recognition

  7. Click the Gear icon to fine-tune the generation of IOC-based queries.

    In the menu that appears, you can do the following:

    • Select what IOC types to use for queries. The following IOC types are supported:

      • Hash

      • Domain

      • URL

      • IP

      • Email

      • File

    • Set the number of IOCs per query to take into account the performance of your platform

    • Select what hash types to use for queries if the hash is enabled as an IOC type

    • Set up new or select existing platform-specific IOC field mapping profiles. Use this feature if your data schema has non-standard field names for:

      • Destination IP

      • Source IP

      • Domain

      • URL

      • Emails

      • Files

      • Md5

      • Sha1

      • Sha256

      • Sha512

    • Define exceptions: specify hashes, domains, IPs, emails, files, or URLs (in full or only partially) present in the input you want to exclude from your queries

    • Choose if you want to add the source IP to your queries with the OR operator

  8. Click Generate.

  9. The generated IOC queries are displayed in the output panel and are ready for hunting in the selected platform.

Next Steps

After you've ensured that the generated query fits your needs and preferences, you can:

  • Save it to a custom repository

  • Run it in your SIEM/EDR/Data Lake or push it to a Git repository

  • Copy the query to the clipboard and paste it into your system or download the query as a file

  • Translate it into a different language

  • Validate its syntax and structure

  • Optimize the query

  • Group query results

  • Get its short summary, full summary, or decision tree

  • Make custom modifications with AI

Supported Platforms

To find out what platforms (languages) are supported, see this article.

Did this answer your question?