performing-indicator-lifecycle-management

Indicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes f

Jump to install

Repository: xalgord/xalgorix
Last source activity: June 6, 2026 at 16:41
Detected SKILL.md language: English
Stars: 813
Forks: 146

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

Back to search Back to installation

name	performing-indicator-lifecycle-management
description	Indicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes f
domain	cybersecurity
subdomain	threat-intelligence
tags	["threat-intelligence","cti","ioc","mitre-attack","stix","indicator-lifecycle","ioc-management"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]

Performing Indicator Lifecycle Management

Overview

Indicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes for IOC quality assessment, aging policies, confidence scoring decay, false positive tracking, hit-rate monitoring, and automated expiration to maintain a high-quality, actionable indicator database that minimizes analyst fatigue and maximizes detection efficacy.

When to Use

When conducting security assessments that involve performing indicator lifecycle management
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Detection Gaps & Validation

Quality gaps before deployment: IOCs ingested from feeds without validation poison detection - a domain on a CDN, a shared-hosting IP, or a sinkholed C2 generates endless false positives. Validate every indicator against enrichment (VirusTotal detection ratio, Shodan/passive DNS, WHOIS age) and tag shared-infrastructure indicators as low-confidence or context-only, never block.
Decay is an assumption, not truth: the half-life model (IP 30d, domain 90d, hash 365d) is a heuristic; a long-lived bulletproof-hosted C2 or a still-circulating malware hash can outlive its window. Override decay with observed last_seen and hit data rather than trusting the curve blindly.
Hit-rate blind spots: an IOC with zero hits may be stale or the data source feeding the detection may have no visibility (no DNS logs, no TLS inspection). Distinguish "no hits because retired threat" from "no hits because no telemetry" before retiring.
How to confirm before retiring: cross-reference a retirement candidate against current feeds and passive DNS; if the infrastructure still resolves/responds, extend rather than expire. Track false-positive provenance so one noisy analyst report does not retire a valid indicator.

Prerequisites

Python 3.9+ with pymisp, requests, stix2 libraries
MISP or OpenCTI instance for indicator storage
SIEM with IOC watchlist capabilities (Splunk, Elastic)
Understanding of IOC types, confidence scoring, and TLP classifications

Key Concepts

Indicator Lifecycle Phases

Discovery: IOC first identified from threat intelligence, malware analysis, or incident response

from datetime import datetime, timedelta
from enum import Enum

class IOCState(Enum):
    DISCOVERED = "discovered"
    VALIDATED = "validated"
    ENRICHED = "enriched"
    DEPLOYED = "deployed"
    MONITORING = "monitoring"
    UNDER_REVIEW = "under_review"
    RETIRED = "retired"

class IOCLifecycle:
    def __init__(self, ioc_type, value, source, initial_confidence=50):
        self.ioc_type = ioc_type
        self.value = value
        self.source = source
        self.confidence = initial_confidence
        self.state = IOCState.DISCOVERED
        self.created = datetime.utcnow()
        self.last_updated = datetime.utcnow()
        self.last_seen = None
        self.hit_count = 0
        self.false_positive_count = 0
        self.history = [{"state": "discovered", "timestamp": self.created.isoformat()}]

    def transition(self, new_state: IOCState, reason=""):
        self.state = new_state
        self.last_updated = datetime.utcnow()
        self.history.append({
            "state": new_state.value,
            "timestamp": self.last_updated.isoformat(),
            "reason": reason,
        })

    def apply_decay(self):
        """Apply confidence decay based on IOC type half-life."""
        half_lives = {"ip": 30, "domain": 90, "hash": 365, "url": 60}
        half_life = half_lives.get(self.ioc_type, 90)
        age_days = (datetime.utcnow() - self.created).days
        decay_factor = 0.5 ** (age_days / half_life)
        self.confidence = max(0, int(self.confidence * decay_factor))

    def record_hit(self, is_true_positive=True):
        self.hit_count += 1
        self.last_seen = datetime.utcnow()
        if not is_true_positive:
            self.false_positive_count += 1
            if self.false_positive_count > 3:
                self.transition(IOCState.UNDER_REVIEW, "Excessive false positives")

    def should_retire(self):
        max_ages = {"ip": 90, "domain": 180, "hash": 730, "url": 120}
        max_age = max_ages.get(self.ioc_type, 180)
        age_days = (datetime.utcnow() - self.created).days
        return age_days > max_age and self.hit_count == 0