3 files changed, 74 insertions, 0 deletions
diff --git a/pkgs/development/python-modules/iocsearcher/default.nix b/pkgs/development/python-modules/iocsearcher/default.nix
new file mode 100644
index 000000000000..a3f7e910664c
--- /dev/null
+++ b/pkgs/development/python-modules/iocsearcher/default.nix
@@ -0,0 +1,70 @@
+{ lib
+, beautifulsoup4
+, buildPythonPackage
+, fetchFromGitHub
+, base58
+, bech32
+, cashaddress
+, cbor
+, eth-hash
+, intervaltree
+, langdetect
+, lxml
+, pdfminer-six
+, phonenumbers
+, python-magic
+, readabilipy
+, pytestCheckHook
+, pythonOlder
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "iocsearcher";
+  version = "2.3-unstable-2024-03-04";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "malicialab";
+    repo = "iocsearcher";
+    rev = "5f7b87761f2195eb358006f3492f0beac7ecc4b0";
+    hash = "sha256-SYh0+JEZa95iBznNzXut/9Vwof6VFeSlt0/g+XmMPC0=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    base58
+    beautifulsoup4
+    bech32
+    cashaddress
+    cbor
+    eth-hash
+    intervaltree
+    langdetect
+    lxml
+    pdfminer-six
+    phonenumbers
+    python-magic
+    readabilipy
+  ] ++ eth-hash.optional-dependencies.pycryptodome;
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "iocsearcher"
+  ];
+
+  meta = with lib; {
+    description = "Library and command line tool for extracting indicators of compromise (IOCs)";
+    homepage = "https://github.com/malicialab/iocsearcher";
+    changelog = "https://github.com/malicialab/iocsearcher/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d67a3d59f553..6987ce7e5271 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9382,6 +9382,8 @@ with pkgs;
 
   iocextract = with python3Packages; toPythonApplication iocextract;
 
+  iocsearcher = with python3Packages; toPythonApplication iocsearcher;
+
   ioping = callPackage ../tools/system/ioping { };
 
   ior = callPackage ../tools/system/ior { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e8b733e94173..ce571c161c6d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5700,6 +5700,8 @@ self: super: with self; {
 
   invoke = callPackage ../development/python-modules/invoke { };
 
+  iocsearcher = callPackage ../development/python-modules/iocsearcher { };
+
   iodata = callPackage ../development/python-modules/iodata { };
 
   iocapture = callPackage ../development/python-modules/iocapture { };