extract_ioc_targets (ioc)

Extracts indicators of compromise (URLs, IPs, domains, hashes, emails, file paths, suspicious tools) from free-text investigation context using regex, with deduplication and false-positive filtering.

def extract_ioc_targets(investigation_context: str) -> dict[str, list[str]]:
    """Extract Indicators of Compromise from investigation context text.

    Uses regex patterns to identify URLs, IPv4 addresses, domains,
    hashes (MD5/SHA1/SHA256), email addresses, Windows and absolute
    POSIX file paths, executable/script/library filenames, and known
    malicious tool keywords.

    Args:
        investigation_context: Free-text investigation context string.

    Returns:
        A dict mapping IOC category names to deduplicated lists of
        extracted values.  Returns an empty dict if no IOCs are found.
    """
    text = stringify_value(investigation_context)
    if not text:
        return {}

    urls = unique_preserve_order(IOC_URL_RE.findall(text))
    ips = unique_preserve_ord

... (truncated -- full source via MCP)