@iocium/ioc-diff
Version:
A full-featured, ESM-compatible IOC diffing and normalization library + CLI for InfoSec tooling.
97 lines (91 loc) • 16.6 kB
HTML
<html class="default" lang="en" data-base="./"><head><meta charset="utf-8"/><meta http-equiv="x-ua-compatible" content="IE=edge"/><title>@iocium/ioc-diff</title><meta name="description" content="Documentation for @iocium/ioc-diff"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="stylesheet" href="assets/style.css"/><link rel="stylesheet" href="assets/highlight.css"/><script defer src="assets/main.js"></script><script async src="assets/icons.js" id="tsd-icons-script"></script><script async src="assets/search.js" id="tsd-search-script"></script><script async src="assets/navigation.js" id="tsd-nav-script"></script></head><body><script>document.documentElement.dataset.theme = localStorage.getItem("tsd-theme") || "os";document.body.style.display="none";setTimeout(() => window.app?app.showPage():document.body.style.removeProperty("display"),500)</script><header class="tsd-page-toolbar"><div class="tsd-toolbar-contents container"><a href="index.html" class="title">@iocium/ioc-diff</a><div id="tsd-toolbar-links"></div><button id="tsd-search-trigger" class="tsd-widget" aria-label="Search"><svg width="16" height="16" viewBox="0 0 16 16" fill="none" aria-hidden="true"><use href="assets/icons.svg#icon-search"></use></svg></button><dialog id="tsd-search" aria-label="Search"><input role="combobox" id="tsd-search-input" aria-controls="tsd-search-results" aria-autocomplete="list" aria-expanded="true" autocapitalize="off" autocomplete="off" placeholder="Search the docs" maxLength="100"/><ul role="listbox" id="tsd-search-results"></ul><div id="tsd-search-status" aria-live="polite" aria-atomic="true"><div>Preparing search index...</div></div></dialog><a href="#" class="tsd-widget menu" id="tsd-toolbar-menu-trigger" data-toggle="menu" aria-label="Menu"><svg width="16" height="16" viewBox="0 0 16 16" fill="none" aria-hidden="true"><use href="assets/icons.svg#icon-menu"></use></svg></a></div></header><div class="container container-main"><div class="col-content"><div class="tsd-page-title"><h1>@iocium/ioc-diff</h1></div><div class="tsd-panel tsd-typography"><h1 id="iociumioc-diff" class="tsd-anchor-link">@iocium/ioc-diff<a href="#iociumioc-diff" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h1><p><a href="https://github.com/iocium/ioc-diff/actions/workflows/test.yml"><img src="https://github.com/iocium/ioc-diff/actions/workflows/test.yml/badge.svg" alt="build"></a>
<a href="https://codecov.io/gh/iocium/favicon-fetcher"><img src="https://codecov.io/gh/iocium/ioc-diff/branch/main/graph/badge.svg" alt="codecov"></a>
<a href="https://github.com/iocium/ioc-diff/blob/main/LICENSE"><img src="https://img.shields.io/npm/l/@iocium/ioc-diff" alt="license"></a></p>
<p>A full-featured, ESM-compatible IOC diffing and normalization library + CLI for InfoSec tooling.</p>
<hr>
<h2 id="🚀-features" class="tsd-anchor-link">🚀 Features<a href="#🚀-features" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h2><ul>
<li>✅ IOC diffing with <code>added</code>, <code>removed</code>, and <code>changed</code> outputs</li>
<li>🧠 Fuzzy matching support (<code>levenshtein</code>)</li>
<li>📥 Support for multiple formats:
<ul>
<li>Plaintext (.txt)</li>
<li>JSON and MISP</li>
<li>CSV (with smart header matching)</li>
<li>YARA rules (.yara)</li>
<li>Sigma rules (.yml / .yaml)</li>
</ul>
</li>
<li>🧪 TypeScript-native with 100% test coverage</li>
<li>📦 Works in Node.js, Cloudflare Workers, and modern browsers</li>
<li>🧼 Built-in validation and deduplication</li>
<li>⚙️ CLI and library modes</li>
</ul>
<hr>
<h2 id="📦-installation" class="tsd-anchor-link">📦 Installation<a href="#📦-installation" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h2><pre><code class="bash"><span class="hl-0">npm</span><span class="hl-1"> </span><span class="hl-2">install</span><span class="hl-1"> </span><span class="hl-2">@iocium/ioc-diff</span>
</code><button type="button">Copy</button></pre>
<hr>
<h2 id="🧰-usage-library" class="tsd-anchor-link">🧰 Usage (Library)<a href="#🧰-usage-library" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h2><pre><code class="ts"><span class="hl-3">import</span><span class="hl-1"> { </span><span class="hl-4">diffIOCs</span><span class="hl-1">, </span><span class="hl-4">parsePlainIOCs</span><span class="hl-1"> } </span><span class="hl-3">from</span><span class="hl-1"> </span><span class="hl-2">'@iocium/ioc-diff'</span><span class="hl-1">;</span><br/><br/><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-6">oldList</span><span class="hl-1"> = </span><span class="hl-0">parsePlainIOCs</span><span class="hl-1">([</span><span class="hl-2">'malicious.com'</span><span class="hl-1">, </span><span class="hl-2">'1.1.1.1'</span><span class="hl-1">]);</span><br/><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-6">newList</span><span class="hl-1"> = </span><span class="hl-0">parsePlainIOCs</span><span class="hl-1">([</span><span class="hl-2">'malicious.com'</span><span class="hl-1">, </span><span class="hl-2">'2.2.2.2'</span><span class="hl-1">]);</span><br/><br/><span class="hl-5">const</span><span class="hl-1"> </span><span class="hl-6">result</span><span class="hl-1"> = </span><span class="hl-0">diffIOCs</span><span class="hl-1">(</span><span class="hl-4">oldList</span><span class="hl-1">, </span><span class="hl-4">newList</span><span class="hl-1">, {</span><br/><span class="hl-1"> </span><span class="hl-4">matchBy:</span><span class="hl-1"> </span><span class="hl-2">'value+type'</span><span class="hl-1">,</span><br/><span class="hl-1"> </span><span class="hl-4">compareTags:</span><span class="hl-1"> </span><span class="hl-5">true</span><span class="hl-1">,</span><br/><span class="hl-1"> </span><span class="hl-4">fuzzyMatch:</span><span class="hl-1"> </span><span class="hl-5">true</span><span class="hl-1">,</span><br/><span class="hl-1"> </span><span class="hl-4">fuzzyThreshold:</span><span class="hl-1"> </span><span class="hl-7">0.9</span><br/><span class="hl-1">});</span><br/><br/><span class="hl-4">console</span><span class="hl-1">.</span><span class="hl-0">log</span><span class="hl-1">(</span><span class="hl-4">result</span><span class="hl-1">.</span><span class="hl-4">added</span><span class="hl-1">); </span><span class="hl-8">// IOCs in new but not old</span><br/><span class="hl-4">console</span><span class="hl-1">.</span><span class="hl-0">log</span><span class="hl-1">(</span><span class="hl-4">result</span><span class="hl-1">.</span><span class="hl-4">removed</span><span class="hl-1">); </span><span class="hl-8">// IOCs in old but not new</span><br/><span class="hl-4">console</span><span class="hl-1">.</span><span class="hl-0">log</span><span class="hl-1">(</span><span class="hl-4">result</span><span class="hl-1">.</span><span class="hl-4">changed</span><span class="hl-1">); </span><span class="hl-8">// Matching IOCs with tag/severity differences</span>
</code><button type="button">Copy</button></pre>
<hr>
<h2 id="🖥️-usage-cli" class="tsd-anchor-link">🖥️ Usage (CLI)<a href="#🖥️-usage-cli" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h2><pre><code class="bash"><span class="hl-0">ioc-diff</span><span class="hl-1"> </span><span class="hl-5">--old</span><span class="hl-1"> </span><span class="hl-2">old.csv</span><span class="hl-1"> </span><span class="hl-5">--new</span><span class="hl-1"> </span><span class="hl-2">new.csv</span><span class="hl-1"> </span><span class="hl-5">--old-format</span><span class="hl-1"> </span><span class="hl-2">csv</span><span class="hl-1"> </span><span class="hl-5">--new-format</span><span class="hl-1"> </span><span class="hl-2">csv</span>
</code><button type="button">Copy</button></pre>
<h3 id="🔧-options" class="tsd-anchor-link">🔧 Options<a href="#🔧-options" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h3><table>
<thead>
<tr>
<th>Flag</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>--old</code></td>
<td>Path to old IOC file</td>
</tr>
<tr>
<td><code>--new</code></td>
<td>Path to new IOC file</td>
</tr>
<tr>
<td><code>--old-format</code></td>
<td>Override format detection</td>
</tr>
<tr>
<td><code>--new-format</code></td>
<td>Override format detection</td>
</tr>
<tr>
<td><code>--fuzzy</code></td>
<td>Enable fuzzy matching</td>
</tr>
<tr>
<td><code>--threshold</code></td>
<td>Fuzzy similarity threshold (0–1)</td>
</tr>
</tbody>
</table>
<h3 id="📁-supported-formats" class="tsd-anchor-link">📁 Supported Formats<a href="#📁-supported-formats" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h3><ul>
<li><code>plaintext</code></li>
<li><code>json</code></li>
<li><code>misp</code></li>
<li><code>csv</code></li>
<li><code>yara</code></li>
<li><code>sigma</code></li>
</ul>
<h3 id="🧪-example" class="tsd-anchor-link">🧪 Example<a href="#🧪-example" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h3><pre><code class="bash"><span class="hl-0">ioc-diff</span><span class="hl-1"> </span><span class="hl-5">--old</span><span class="hl-1"> </span><span class="hl-2">iocs_old.txt</span><span class="hl-1"> </span><span class="hl-5">--new</span><span class="hl-1"> </span><span class="hl-2">iocs_new.txt</span><br/><span class="hl-0">ioc-diff</span><span class="hl-1"> </span><span class="hl-5">--old</span><span class="hl-1"> </span><span class="hl-2">old.json</span><span class="hl-1"> </span><span class="hl-5">--new</span><span class="hl-1"> </span><span class="hl-2">new.csv</span><span class="hl-1"> </span><span class="hl-5">--old-format</span><span class="hl-1"> </span><span class="hl-2">json</span><span class="hl-1"> </span><span class="hl-5">--new-format</span><span class="hl-1"> </span><span class="hl-2">csv</span>
</code><button type="button">Copy</button></pre>
<hr>
<h2 id="📚-advanced-features" class="tsd-anchor-link">📚 Advanced Features<a href="#📚-advanced-features" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h2><ul>
<li>Auto-type inference (<code>ip</code>, <code>domain</code>, <code>url</code>, <code>email</code>, <code>sha256</code>, <code>md5</code>)</li>
<li>Duplicate suppression by <code>value+type</code></li>
<li>Optional matching by value only (<code>matchBy: 'value'</code>)</li>
<li>Extensible IOC schema with <code>tags</code>, <code>severity</code>, <code>source</code></li>
<li>Fully typed API with <code>DiffOptions</code>, <code>IOC</code>, and <code>IOCDiffResult</code></li>
</ul>
<hr>
<h2 id="🧪-testing" class="tsd-anchor-link">🧪 Testing<a href="#🧪-testing" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h2><pre><code class="bash"><span class="hl-0">npm</span><span class="hl-1"> </span><span class="hl-2">run</span><span class="hl-1"> </span><span class="hl-2">build</span><br/><span class="hl-0">npm</span><span class="hl-1"> </span><span class="hl-2">test</span><span class="hl-1"> </span><span class="hl-5">--</span><span class="hl-1"> </span><span class="hl-5">--coverage</span>
</code><button type="button">Copy</button></pre>
<hr>
<h2 id="📄-license" class="tsd-anchor-link">📄 License<a href="#📄-license" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h2><p>MIT</p>
<hr>
<h2 id="✨-contributing" class="tsd-anchor-link">✨ Contributing<a href="#✨-contributing" aria-label="Permalink" class="tsd-anchor-icon"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="assets/icons.svg#icon-anchor"></use></svg></a></h2><p>PRs welcome! Please write tests and follow ESM-compatible conventions.</p>
</div></div><div class="col-sidebar"><div class="page-menu"><div class="tsd-navigation settings"><details class="tsd-accordion"><summary class="tsd-accordion-summary"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" aria-hidden="true"><use href="assets/icons.svg#icon-chevronDown"></use></svg><h3>Settings</h3></summary><div class="tsd-accordion-details"><div class="tsd-filter-visibility"><span class="settings-label">Member Visibility</span><ul id="tsd-filter-options"><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-protected" name="protected"/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>Protected</span></label></li><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-inherited" name="inherited" checked/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>Inherited</span></label></li><li class="tsd-filter-item"><label class="tsd-filter-input"><input type="checkbox" id="tsd-filter-external" name="external"/><svg width="32" height="32" viewBox="0 0 32 32" aria-hidden="true"><rect class="tsd-checkbox-background" width="30" height="30" x="1" y="1" rx="6" fill="none"></rect><path class="tsd-checkbox-checkmark" d="M8.35422 16.8214L13.2143 21.75L24.6458 10.25" stroke="none" stroke-width="3.5" stroke-linejoin="round" fill="none"></path></svg><span>External</span></label></li></ul></div><div class="tsd-theme-toggle"><label class="settings-label" for="tsd-theme">Theme</label><select id="tsd-theme"><option value="os">OS</option><option value="light">Light</option><option value="dark">Dark</option></select></div></div></details></div><details open class="tsd-accordion tsd-page-navigation"><summary class="tsd-accordion-summary"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" aria-hidden="true"><use href="assets/icons.svg#icon-chevronDown"></use></svg><h3>On This Page</h3></summary><div class="tsd-accordion-details"><a href="#iociumioc-diff"><span>@iocium/ioc-<wbr/>diff</span></a><ul><li><a href="#🚀-features"><span>🚀 <wbr/>Features</span></a></li><li><a href="#📦-installation"><span>📦 <wbr/>Installation</span></a></li><li><a href="#🧰-usage-library"><span>🧰 <wbr/>Usage (<wbr/>Library)</span></a></li><li><a href="#🖥️-usage-cli"><span>🖥️ <wbr/>Usage (<wbr/>CLI)</span></a></li><li><ul><li><a href="#🔧-options"><span>🔧 <wbr/>Options</span></a></li><li><a href="#📁-supported-formats"><span>📁 <wbr/>Supported <wbr/>Formats</span></a></li><li><a href="#🧪-example"><span>🧪 <wbr/>Example</span></a></li></ul></li><li><a href="#📚-advanced-features"><span>📚 <wbr/>Advanced <wbr/>Features</span></a></li><li><a href="#🧪-testing"><span>🧪 <wbr/>Testing</span></a></li><li><a href="#📄-license"><span>📄 <wbr/>License</span></a></li><li><a href="#✨-contributing"><span>✨ <wbr/>Contributing</span></a></li></ul></div></details></div><div class="site-menu"><nav class="tsd-navigation"><a href="modules.html">@iocium/ioc-diff</a><ul class="tsd-small-nested-navigation" id="tsd-nav-container"><li>Loading...</li></ul></nav></div></div></div><footer><p class="tsd-generator">Generated using <a href="https://typedoc.org/" target="_blank">TypeDoc</a></p></footer><div class="overlay"></div></body></html>