Project
IOC Reputation Checker
Cybersecurity-oriented REST API that reproduces a complete indicator-of-compromise analysis flow, from classification and local scoring to simulated enrichment, persistence and later result retrieval.
Overview
Backend API for analysing indicators of compromise, classifying them, applying local risk rules, simulating OSINT enrichment and storing results for later queries.
Stack: Python 3.13, FastAPI, Uvicorn, Pydantic, SQLAlchemy, PostgreSQL 16, Alembic, Docker Compose, Pytest, HTTPX, Ruff, GitHub Actions
What it does
The project is designed to represent how a backend service for analysing IOCs could be technically organised without depending on real external providers. The goal is to receive indicators such as IP addresses, domains, URLs or hashes, detect their type, apply explainable risk rules and keep a history that supports analysis retrieval, searches and statistics.
How it is built
The solution is developed with FastAPI and organised into endpoint, schema, service, repository, model and configuration layers. Its logic is divided into dedicated services for IOC type detection, local scoring, simulated OSINT enrichment and final risk calculation. Analyses and provider results are stored in PostgreSQL through SQLAlchemy, while Alembic manages database migrations. The local environment uses Docker Compose and the API runs with Uvicorn, with interactive documentation available through Swagger.
What it validates or automates
The API validates the detection of IP addresses, domains, URLs and MD5, SHA1 and SHA256 hashes, while applying local rules to signals such as HTTP usage, IP-based URLs or suspicious terms. The project includes unit and integration tests for scoring, the simulated provider, final risk calculation, persistence and the main endpoints. GitHub Actions starts PostgreSQL, applies Alembic migrations and automatically runs Ruff and Pytest. The documented final state records 45 passing tests and no Ruff errors.
Key points
- Complete IOC analysis flow with classification, explainable local scoring and enrichment through a simulated OSINT provider.
- PostgreSQL persistence with history, searches, statistics and individual analysis retrieval through a REST API.
- Layered architecture, Alembic migrations, 45 passing tests and CI with PostgreSQL, Ruff and Pytest in GitHub Actions.