Stop Wasting Time on Manual IOC Lookups: ThreatLens Automates OSINT in the Terminal

The ThreatLens Python CLI tool eliminates the bottleneck of manually pasting IP addresses into multiple threat intelligence websites, saving Security Operations Center (SOC) analysts countless hours. Built for rapid Indicator of Compromise (IOC) enrichment, this newly featured command-line utility queries six major Open Source Intelligence (OSINT) APIs simultaneously. Instead of forcing users to switch between browser tabs, it aggregates the data and outputs the results directly into color-coded Excel spreadsheets, JSON, or CSV files.

Designed to operate entirely on free API tiers, ThreatLens integrates seamlessly with VirusTotal, Shodan, AbuseIPDB, AlienVault OTX, URLScan.io, and the NIST National Vulnerability Database (NVD). The tool features a local SQLite cache to make repeated lookups instant, alongside a strict request budget cap to prevent runaway API usage. Crucially for enterprise environments, all values written to Excel and CSV files are neutralized against formula-injection attacks, ensuring that malicious IOCs cannot execute code when opened by analysts.

ThreatLens requires Python and can be installed directly from its GitHub repository. The NVD API for CVE lookups works out of the box without an API key, while other services require standard free-tier registration.

1. Clone the repository and install the required dependencies:

git clone https://github.com/AbdaullahAG/threatlens.git
cd threatlens
pip install -r requirements.txt

2. Configure your API keys by copying the example environment file and editing it with your credentials:

cp config/keys.env.example config/keys.env

3. Run a basic single-IOC lookup against a suspicious IP address:

python main.py -i 45.33.32.156

4. Parse a raw log file to auto-extract and investigate all IOCs, generating Excel, JSON, and CSV reports simultaneously:

python main.py --file /var/log/apache2/access.log --format all

ThreatLens offers granular control over how data is processed and exported. Here are the most critical flags for daily SOC operations:

Flag	Description
-i, --ip	IP address(es) to investigate
-d, --domain	Domain(s) to investigate
-c, --cve	CVE ID(s), e.g., CVE-2021-44228
--file	Path to a log/text file to auto-extract IOCs from
--apis	Restrict enrichment to a specific set of APIs (e.g., abuseipdb virustotal)
--format	Output format: excel (default), json, csv, or all

The standout feature of ThreatLens isn't just its API aggregation - it is the deliberate choice to output color-coded Excel reports alongside machine-readable JSON. In modern SOC environments, engineers live in the terminal, but incident reporting, compliance audits, and executive summaries are almost exclusively managed in spreadsheets. By automating the translation of raw JSON threat data into a sanitized, visually accessible Excel file, ThreatLens bridges the communication gap between technical responders and non-technical stakeholders.

Furthermore, the built-in formula-injection protection highlights a mature understanding of operational security. Threat actors frequently craft malicious hostnames or user-agent strings designed to execute macros when exported to CSV or Excel. By neutralizing prefixes like = and @, ThreatLens ensures that the act of investigating a threat does not inadvertently become a vector for compromise.