Indicators and safe sharing

Indicators are the concrete traces of an investigation: links, domains, e-mail addresses, IP addresses, file hashes and crypto identifiers. The Indicators tab (key 4) helps you collect them from text and share them without creating clickable links.

1. Extract indicators from text

Paste an alert, an e-mail or a report into Text to inspect in the Indicator extractor card. The table updates as you type and lists each indicator with its type and number of occurrences, for example:

• URL — hxxps://login.examplecorp-verify[.]example/owa/?id=8812 (defanged forms are recognized),
• IPv4 address, E-mail address, Domain,
• Hash (MD5, SHA-1 or SHA-256),
• Bitcoin address (checksum checked) and Ethereum address (format checked).

File names such as invoice.pdf are not treated as domains. Indicators that are already in the active case are marked already in this case and cannot be added twice.

Untick the rows you do not want and press Add selected to the case. Each indicator becomes an Indicator entry tagged #extracted in the research log, with its type set. Nothing was looked up — matches are leads, not findings.

You can also start from File → Add indicators from text…, by importing a text or CSV file, by dropping a .txt file on the desk, or by receiving text from another usefulweb app through the App Bridge. All of these open the same review dialog first; nothing changes until you press Add to the case.

2. Defang and refang

The Defang and refang card converts a passage: Defang (make safe to share) turns https://example.org into hxxps://example[.]org and 192.0.2.44 into 192[.]0[.]2[.]44; Refang (restore for analysis) does the reverse. The line below the result says how many recognized indicators changed. Hashes and crypto identifiers stay as they are. Copy result puts the text on the clipboard.

3. The case’s indicator list

Indicators in this case lists every indicator entry, already defanged. Copy defanged list copies them one per line — ready for a ticket or a block list review — and Download list saves them as a text file. The same list is available under Export → Defanged indicator list.

When an indicator also appears in another case of the workspace, the card shows Also found in other cases with the case names. That is a useful hint that two investigations may be connected — and a reminder to check before you merge them.

4. Copy values safely from the log

Every entry’s More actions menu has Copy value and Copy defanged value. The case report also shows all values defanged, so a printed or forwarded report cannot be clicked by accident.

Good practice

• Keep the original message or report as a source entry; extracted indicators are copies.
• Add context to the indicators that matter (Edit → Context): where you saw it and why it matters.
• Mark indicators as Needs follow-up until you have checked them with a lookup or a second source.

Next: Crypto leads and local files.