tools
2026-07Automated Phishing & Threat Intelligence IOC Triage Utility
Built a Python CLI workflow that parses suspicious email files (.eml), extracts URLs, IPs, and SHA-256 attachment hashes, and enriches them via threat intelligence APIs.
Attack: Spear-phishing emails utilizing lookalike domains, display-name spoofing, and weaponized attachments.
Detection: Automated header alignment verification (SPF/DKIM/DMARC) paired with SHA-256 reputation lookups.
Mitigation: Standardized incident triage notes into repeatable markdown reports for faster analyst review.