Indicator Extractor
Go Shell
Latest commit 5b58476 Dec 9, 2016 @sroberts committed on GitHub Merge pull request #26 from sroberts/revert-25-add-coverage
Revert "formaized a circle.yml and added codecov"


CircleCI Go Report Card

Cacador (Portugese for hunter) is tool for extracting common indicators of compromise from a block of text.

The Short Way: Downloading Cacador

The easiest way to get cacador is to download the latest release for your platform. Good? Great.

The Long Way: Compiling Cacador

  • Install golang
  • go get
  • Compile with go build


Run with ./cacador. It accepts text from stdin and writes a JSON blob of IOCs to stdout. For example cat text.txt | ./cacador | import where text is some IOC rich text and import pushes your new IOCs into your threat management system.

Cacador does recognize two command line flags:

  • -comment="Foo" which makes it possible to leave a note as metadata.
  • -tags="Foo, bar, baz" which adds tags.


Other tools for doing indicator extraction are pretty awesome (like armbues/ioc_parser or sroberts/jager), but what's nice about cacador is you can compile it and put it in your path and use it for Unix style workflows with pipes and things. Also it's super fast and was a good excuse to learn Go.