Performing Indicator Lifecycle Management

---
name: performing-indicator-lifecycle-management
description: Indicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, Dağıt:ment, monitoring, and eventual retirement. bu skill covers implementing systematic
  processes f
tags:
- siber-güvenlik
- threat-intelligence
- ioc-management
- cti
- stix
- fetih
- mitre-attack
- cybersecurity
- indicator-lifecycle
- ioc
triggers:
- IOC
- alert
- dns
- hash
- http
- incident
- indicator
- indicator of compromise
- lifecycle
- malware
- management
- performing
category: threat-intelligence
source_subdomain: threat-intelligence
nist_csf:
- ID.RA-01
- ID.RA-05
- DE.CM-01
- DE.AE-02
adapted_for: fetih
---

# Performing Indicator Lifecycle Management


## Genel Bakış

Indicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, Dağıt:ment, monitoring, and eventual retirement. bu skill covers implementing systematic processes for IOC quality assessment, aging policies, confidence scoring decay, false positive tracking, hit-rate monitoring, and automated expiration to maintain a high-quality, actionable indicator database that minimizes analyst fatigue and maximizes Tespit efficacy.


## Ne Zaman Kullanılır

- conducting yaparken security assessments that involve performing indicator lifecycle management
- following yaparken: incident response procedures for related security events
- performing yaparken scheduled security testing or auditing activities
- validating yaparken security controls through hands-on testing

## Ön Gereksinimler

- Python 3.9+ with `pymisp`, `requests`, `stix2` libraries
- MISP or OpenCTI instance for indicator storage
- SIEM with IOC watchlist capabilities (Splunk, Elastic)
- Understanding of IOC types, confidence scoring, and TLP classifications

## Key Concepts

### Indicator Lifecycle Phases
1. **Discovery**: IOC first identified from threat intelligence, malware analysis, or incident response
2. **Validation**: IOC verified against enrichment sources (VirusTotal, Shodan)
3. **Enrichment**: Additional context added (WHOIS, passive DNS, threat actor attribution)
4. **Dağıt:ment**: IOC pushed to Tespit systems (SIEM, IDS, firewall)
5. **Monitoring**: Track hit rates, false positive rates, Tespit efficacy
6. **Review**: Periodic assessment of IOC relevance and accuracy
7. **Retirement**: IOC expired or removed based on aging policy

### Confidence Decay
Indicator confidence decreases over time as adversaries rotate infrastructure. A time-based decay function reduces confidence scores automatically, ensuring old indicators do not generate excessive alerts. Typical half-life: IP addresses (30 days), domains (90 days), file hashes (365 days).

### Quality Metrics
- **Hit Rate**: Percentage of Dağıtılmış IOCs generating true positive alerts
- **False Positive Rate**: Percentage of IOC alerts that are benign
- **Coverage**: Percentage of known threat techniques with IOC coverage
- **Freshness**: Average age of active indicators in the database

## İş Akışı

### Adım 1: Implement IOC Lifecycle State Machine

```python
from datetime import datetime, timedelta
from enum import Enum

class IOCState(Enum):
    DISCOVERED = "discovered"
    VALIDATED = "validated"
    ENRICHED = "enriched"
    Dağıt:ED = "Dağıtılmış"
    MONITORING = "monitoring"
    UNDER_REVIEW = "under_review"
    RETIRED = "retired"

class IOCLifecycle:
    def __init__(self, ioc_type, value, source, initial_confidence=50):
        self.ioc_type = ioc_type
        self.value = value
        self.source = source
        self.confidence = initial_confidence
        self.state = IOCState.DISCOVERED
        self.created = datetime.utcnow()
        self.last_updated = datetime.utcnow()
        self.last_seen = None
        self.hit_count = 0
        self.false_positive_count = 0
        self.history = [{"state": "discovered", "timestamp": self.created.isoformat()}]

    def transition(self, new_state: IOCState, reason=""):
        self.state = new_state
        self.last_updated = datetime.utcnow()
        self.history.append({
            "state": new_state.value,
            "timestamp": self.last_updated.isoformat(),
            "reason": reason,
        })

    def apply_decay(self):
        """Apply confidence decay based on IOC type half-life."""
        half_lives = {"ip": 30, "domain": 90, "hash": 365, "url": 60}
        half_life = half_lives.get(self.ioc_type, 90)
        age_days = (datetime.utcnow() - self.created).days
        decay_factor = 0.5 ** (age_days / half_life)
        self.confidence = max(0, int(self.confidence * decay_factor))

    def record_hit(self, is_true_positive=True):
        self.hit_count += 1
        self.last_seen = datetime.utcnow()
        if not is_true_positive:
            self.false_positive_count += 1
            if self.false_positive_count > 3:
                self.transition(IOCState.UNDER_REVIEW, "Excessive false positives")

    def should_retire(self):
        max_ages = {"ip": 90, "domain": 180, "hash": 730, "url": 120}
        max_age = max_ages.get(self.ioc_type, 180)
        age_days = (datetime.utcnow() - self.created).days
        return age_days > max_age and self.hit_count == 0
```

## Doğrulama Criteria

- IOC lifecycle state machine transitions correctly between phases
- Confidence decay reduces scores based on IOC type half-life
- Hit rate and false positive tracking functional
- Aging policy automatically flags indicators for review/retirement
- Quality metrics dashboard shows IOC database health

## References

- [MISP Indicator Lifecycle](https://www.misp-project.org/)
- [STIX Indicator Valid From/Until](https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html)
- [IOC Quality Framework](https://www.first.org/)

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: 17020f05714793d1
-->