Which formats can it export to?

CSV, STIX 2.1, Mandiant OpenIOC XML and MISP JSON. You choose the format for the consumer, and the skill maps each indicator to the correct fields or attribute types for that target.

Does it clean up the indicators first?

Yes. It deduplicates entries that share the same indicator and type, validates formats such as IP addresses and hash lengths, and carries TLP markings and confidence scores through to the export so the output is consistent and ready to share.

Is the IOC export skill free?

Yes. It is part of the open-source, MIT-licensed CTI Skills pack, so you can run it, read how it handles each format, and adapt it to your own sharing pipeline at no cost.

CTI Skill · Intelligence production

IOC Export.

/ioc-export

When you need to export IOCs into the format a tool or partner expects, this skill handles the conversion and packaging. Hand it a set of indicators and it produces CSV, STIX 2.1, OpenIOC or MISP output, deduplicating entries, validating each indicator type, and applying TLP and confidence so the file imports cleanly wherever it lands.

Get the free pack on GitHub →Or join the free tier waitlist

What it does.

The skill takes a collection of indicators and exports them in your chosen format: tabular CSV, a STIX 2.1 bundle, Mandiant OpenIOC XML, or MISP-ready JSON. Along the way it deduplicates by indicator and type, validates formats such as IP and hash patterns, applies TLP markings, sets confidence scores, and maps each IOC to the correct attribute type for the target format.

When to use it.

Use it whenever indicators have to move between tools or organisations that speak different formats: a CSV for a spreadsheet or a simple blocklist, OpenIOC for a tool that still expects it, MISP JSON for a community instance, or STIX for a TAXII feed. It suits analysts who routinely repackage the same intelligence for different consumers.

What you get back.

An export file in the requested format with the columns or objects each one needs: CSV with typed indicator rows and context, MISP JSON with correctly categorised attributes, OpenIOC XML with proper context documents, or a STIX 2.1 bundle. The set is deduplicated and validated, with TLP and confidence carried through so nothing is lost in translation.

How it fits your workflow.

It is one of the open-source CTI Skills that run inside an AI coding agent like Claude Code. You point it at your indicators in the terminal and get a ready-to-share file out. It complements the STIX bundle and MISP skills in the pack, and works well as the final step after an enrichment workflow has cleaned and scored the indicators you want to distribute.

Keep going.

Frequently Asked Questions.

Ready to do more with less?

Request a demo or start your free trial today. Get instant access to AI-powered threat intelligence tailored to your organisation.