MENU
A cybersecurity analyst receives an unstructured text document that contains advanced persistent threat (APT)-related indicators of compromise (IoCs). The analyst needs to extract the IPv4 addresses.
Which of the following is the best tool to accomplish this task?
CyberChef is the most appropriate option because the task involves parsing and extracting structured indicators from unstructured text, rather than inspecting network traffic or managing a threat-intelligence repository. CyberChef provides operations for text manipulation, pattern matching, regular expressions, decoding, extraction, and transformation. An analyst can therefore feed the document into CyberChef and identify IPv4 address patterns without manually reviewing potentially thousands of characters.
Wireshark is primarily a packet-analysis platform. It would be appropriate if the analyst needed to inspect packets from a PCAP or live network capture, but the scenario provides a text document. Zeek is a network security monitoring and traffic-analysis framework that converts network activity into structured logs; it is similarly unnecessary for static textual extraction. OpenCTI is a threat-intelligence platform designed to organize, correlate, and manage intelligence objects and relationships. It could store the resulting IoCs after extraction, but it is not the most efficient tool for extracting IPv4 strings from raw text.
The official CS0-004 objectives identify CyberChef under decoding/parsing tools, while Wireshark and Zeek are classified under packet analysis and OpenCTI under threat-intelligence platforms.
Study Guide Reference: Security Operations Tools for Malicious-Activity Analysis Decoding/Parsing CyberChef Pattern Recognition/Regular Expressions IoC Analysis.