From 01e287587b89cef902eafcef93d6b3e8551c3400 Mon Sep 17 00:00:00 2001 From: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> Date: Tue, 13 Oct 2026 10:06:45 -0400 Subject: [PATCH] fix(security): normalize indicators before private IP filtering Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> --- security/security-threat-intelligence-analyst.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/security/security-threat-intelligence-analyst.md b/security/security-threat-intelligence-analyst.md index 758e3e21..5465d5c4 100644 --- a/security/security-threat-intelligence-analyst.md +++ b/security/security-threat-intelligence-analyst.md @@ -493,16 +493,16 @@ class IOCEnrichmentPipeline: results = [] for raw in raw_indicators: - ioc_type = self.classifier.classify(raw) + value = raw.strip() + ioc_type = self.classifier.classify(value) if ioc_type is None: continue # Skip unrecognized indicators # Skip private IPs if ioc_type in (IOCType.IPV4, IOCType.IPV6): - if self.classifier.is_private_ip(raw): + if self.classifier.is_private_ip(value): continue - value = raw.strip() if ioc_type != IOCType.URL: value = value.lower()