TryBench
Disarming Suspicious Links & IOCs
Defang dangerous links and IP addresses so they cannot be accidentally clicked, and structure findings into JSON.
Why this matters
Security teams share attack links in tickets and chats all day. If one is clickable, someone may click it by mistake.
Shared Attack Links Get Clicked
If you paste a live attack link into a ticket, someone may click it. Some chat apps also open links on their own, which can warn the attacker.
In real life: If a sign says "wet paint, do not touch", someone will still touch it. A live link in a ticket works the same way. Make it safe first.
Break Links With [.] and hxxp
Replace each dot with [.] and http:// with hxxp://. The link can no longer be clicked, but people can still read it.
In real life: Defanging means changing a link so it cannot be clicked, for example 185[.]220[.]101[.]44 or hxxp instead of http. A person can still read it easily.
Name the Service Under Attack
Write which service was attacked, such as SSH or HTTP, along with the safe indicators. Then the firewall team knows exactly what to block.
In real life: Saying "someone attacked us" is not helpful. Saying "someone guessed passwords on SSH" tells the team to close that exact door.
Your practice task
From the security log below, have the AI extract the attacker IP, the malware domain (defanging both by replacing dots with [.]), and the targeted server protocol as source_service. Return raw JSON only with keys defanged_ip, defanged_domain, and source_service (no ``` marks).
How to do it
- Read the security alert above.
- Ask the AI to find the attacker IP, the bad domain, and the attacked service.
- Tell it to replace each dot with [.] in the IP and the domain.
- Ask for raw JSON with the three keys and no ``` marks. Press Run proof.
Practice it for free in the app. You get instant checks that show what you got right and what to fix. A lesson takes about two minutes and you can try as many times as you like.
Quick reference: IOC Defanging & Extraction Rule
Standard triage step before posting indicators into security channels.
Extract defanged_ip, defanged_domain, and source_service as JSON. Replace all dots with [.].
More lessons in this course
- Local Redaction & Data PrivacyScrub personal data locally first, and use AI redaction pipelines only with synthetic or pre-cleared text.
- Spotting Fake EmailsDetect sender mismatches, artificial urgency, and scam links with AI triage.
- MFA Fatigue Attack: How to Stop Push BombingRecognize push bombing, advise users to deny prompts, alert IT to revoke sessions, and implement number matching.