@iocium/ioc-diff/dist/index.d.ts

A full-featured, ESM-compatible IOC diffing and normalization library + CLI for InfoSec tooling.

/**
 * Represents a single Indicator of Compromise (IOC).
 */
type IOC = {
    value: string;
    type?: string;
    tags?: string[];
    severity?: 'low' | 'medium' | 'high' | 'critical';
    source?: string;
};
/**
 * The result of comparing two sets of IOCs.
 */
type IOCDiffResult = {
    added: IOC[];
    removed: IOC[];
    changed: {
        before: IOC;
        after: IOC;
    }[];
};
/**
 * Options to customize IOC diff behavior.
 */
type DiffOptions = {
    matchBy?: 'value' | 'value+type';
    compareTags?: boolean;
    compareSeverity?: boolean;
    fuzzyMatch?: boolean;
    fuzzyThreshold?: number;
};

/**
 * Compute the difference between two IOC datasets.
 *
 * @param oldIOCs - The baseline set of IOCs
 * @param newIOCs - The updated set of IOCs
 * @param options - Comparison behavior (e.g. match style, fuzzy match)
 * @returns An object describing added, removed, and changed IOCs
 */
declare function diffIOCs(oldIOCs: IOC[], newIOCs: IOC[], options?: DiffOptions): IOCDiffResult;

/**
 * Convert and validate a list of plain-text IOC values into structured IOC objects.
 * Attempts to infer type based on basic heuristics.
 * Filters out invalid or unrecognized IOCs.
 * Deduplicates based on value+type.
 * @param lines - Plain text IOC values
 * @returns Validated and deduplicated IOC[]
 */
declare function parsePlainIOCs(lines: string[]): IOC[];

export { type DiffOptions, type IOC, type IOCDiffResult, diffIOCs, parsePlainIOCs };