skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-indicator-lifecycle-management

Manage IOC lifecycles from discovery through validation, deployment, monitoring, and retirement.

954|172|Updated Mar 13, 2026
Search Tags:#threat intelligence#siem#ioc#stix#misp#confidence decay#indicator lifecycle
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-indicator-lifecycle-management
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-indicator-lifecycle-management
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/performing-indicator-lifecycle-management
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-indicator-lifecycle-management

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pymisp, requests, stix2.

What problem does it solve?

Threat intelligence feeds flood detection systems with indicators that quickly become stale, generate false positives, or lose relevance as adversaries rotate infrastructure. This Skill implements systematic IOC lifecycle management so analysts maintain a high-quality indicator database instead of drowning in noisy, expired alerts.

Core Features & Use Cases

  • Lifecycle State Machine: Track IOCs through discovery, validation, enrichment, deployment, monitoring, review, and retirement phases with full transition history.
  • Confidence Decay & Aging Policies: Apply time-based confidence decay using per-type half-lives (IP 30 days, domain 90 days, hash 365 days) and automatic retirement thresholds.
  • Quality Metrics Tracking: Monitor hit rates, false positive counts, coverage, and freshness to measure detection efficacy and flag problematic indicators.
  • Use Case: A SOC ingests thousands of IOCs from MISP feeds weekly. Use this Skill to validate each indicator against VirusTotal and passive DNS, deploy only high-confidence IOCs to the SIEM, and automatically retire indicators that exceed their aging policy with zero hits.

Quick Start

Implement an IOC lifecycle state machine in Python that tracks indicators from discovery to retirement with confidence decay and false positive monitoring.

Frequently Asked Questions about performing-indicator-lifecycle-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement an IOC lifecycle management process?▼

Implement a state machine that transitions IOCs through discovery, validation, enrichment, deployment, monitoring, review, and retirement phases. Track hit counts, false positives, and timestamps at each stage, and record transition history for auditability.

What is confidence decay for threat intelligence indicators?▼

Confidence decay automatically reduces an IOC's score over time as adversaries rotate infrastructure. Typical half-lives are 30 days for IP addresses, 90 days for domains, and 365 days for file hashes, applied via an exponential decay function.

How do I validate IOCs before deploying them to a SIEM?▼

Validate IOCs against enrichment sources like VirusTotal detection ratios, Shodan, passive DNS, and WHOIS age before deployment. Tag shared-infrastructure indicators such as CDN domains or sinkholed C2s as low-confidence or context-only, never for blocking.

When should an IOC be retired from the indicator database?▼

Retire an IOC when it exceeds its maximum age (90 days for IPs, 180 for domains, 730 for hashes) with zero hits. Before retiring, cross-reference against current feeds and passive DNS to confirm the infrastructure no longer resolves, since zero hits may mean missing telemetry rather than a dead threat.

What tools are needed for indicator lifecycle management?▼

You need Python 3.9+ with pymisp, requests, and stix2 libraries, plus a MISP or OpenCTI instance for indicator storage and a SIEM with watchlist capabilities such as Splunk or Elastic for deployment and hit monitoring.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

collecting-threat-intelligence-with-misp

Collect threat intelligence from MISP using PyMISP and export IOCs to STIX.

Community
Advanced
augustoheissaugustoheiss

agency-threat-detection-engineer

Detect attacker behaviors in telemetry and generate tested Sigma-based SIEM rules.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

building-adversary-infrastructure-tracking-system

Map threat actor infrastructure from passive DNS, WHOIS, and certificate data.

Community
Advanced
MHaggisMHaggis
471

threat-report-parser

Parse threat reports and generate SIEM-specific detection rules mapped to MITRE ATT&CK.

Community
Advanced