From 87dde74733c62b363567daf3c23ab771b816981f Mon Sep 17 00:00:00 2001 From: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> Date: Fri, 2 Oct 2026 14:21:51 -0400 Subject: [PATCH] Preserve case-sensitive IOC paths and filter private IPv6 addresses Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com> --- security/security-threat-intelligence-analyst.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/security/security-threat-intelligence-analyst.md b/security/security-threat-intelligence-analyst.md index 7dc0479c..4922f46a 100644 --- a/security/security-threat-intelligence-analyst.md +++ b/security/security-threat-intelligence-analyst.md @@ -463,7 +463,7 @@ class IOCClassifier: """Check if an IP is in private/reserved ranges.""" try: addr = ip_address(value) - return any(addr in net for net in cls.PRIVATE_RANGES) + return addr.is_private or addr.is_loopback or addr.is_link_local except ValueError: return False @@ -493,8 +493,12 @@ class IOCEnrichmentPipeline: if self.classifier.is_private_ip(raw): continue + value = raw.strip() + if ioc_type != IOCType.URL: + value = value.lower() + ioc = IOC( - value=raw.strip().lower(), + value=value, ioc_type=ioc_type, first_seen=now, last_seen=now,