What it can do
- Extract IPv4 and IPv6
- Sort and remove duplicates
- Neutralize addresses for reporting
How the recipe works
Extract IP addresses
Find both address families in the text.
Defang IP Addresses
Defang the extracted indicators.
Demonstration
Sample input
Seen 203.0.113.42, 198.51.100.7 and 2001:db8::1.Expected result
203[.]0[.]113[.]42When to use it
- SOC triage
- Threat-intelligence cleanup
- Building block lists
Adapt it
Enable removal of local IPv4 addresses when a report should contain only public indicators.
Source and verification
Adapted from mattnotmax CyberChef recipes. The explanation and sample are written for Serialize, use synthetic or documentation-safe data, and are checked against the current operation catalogue. The workflow runs locally without an external API call.