---
title: "Indicators and network data"
description: "Normalize security indicators for reports without contacting external services."
---

> Documentation Index
> Fetch the complete documentation index at: https://help.serialize.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Indicators and network data

## Learning objectives

- Extract indicators from surrounding text
- Distinguish normalization from validation
- Defang and refang without navigating
- Parse URI and IPv6 structure locally
- Explain why decoded or restored values remain untrusted

## Lab A: report-safe URLs

Install [Extract and defang URLs](/recipes/security-analysis/extract-defang-urls/). Add a duplicate URL and verify that the output remains unique.

Then use [Restore a defanged URL](/recipes/security-analysis/fang-url/) followed by [Parse a URI](/recipes/identifiers-time/parse-uri/). The workflow reconstructs syntax and displays fields; it does not request the destination.

## Lab B: address extraction

Install [Extract and defang IP addresses](/recipes/security-analysis/extract-defang-ips/). Add one private IPv4 address and test the extractor's option to remove local ranges.

## Lab C: IPv6 structure

Open [Inspect a Teredo IPv6 address](/recipes/inspect-teredo-ipv6/). Compare its parsed fields with a documentation address such as `2001:db8::1`.

## Safety boundary

This course deliberately excludes operations that call external services, including HTTP Request, DNS over HTTPS, and map tiles. Extraction, parsing, defanging, and formatting run locally in the page.

## Assignment

Write a synthetic alert containing repeated URLs, IPv4 addresses, an IPv6 address, and unrelated prose. Produce two outputs:

1. A sorted, defanged indicator list for a report
2. A parsed URI record for one synthetic URL

Document which values were normalized but not independently verified.

Source: https://help.serialize.dev/courses/indicators-and-network-data/index.mdx