Building a Multi-Source Threat Intelligence Correlation Engine in Python

A SOC analyst's notes on going from "I want to learn async" to a working tool that other analysts can clone and use.

TL;DR

I'm a SOC analyst learning Python and built IOC Hunter — an async tool that takes a chunk of text (phishing report, log dump, Slack export), extracts every indicator inside, queries six threat-intel sources in parallel, and produces a verdict you can drop into a ticket or a SIEM.

This article is the why and the how — the architectural decisions I had to think through, the things that bit me, and a small dose of "what I learned about myself as an engineer."

platinum2high