Confidence Score
A confidence score quantifies how certain a threat intelligence system is that an indicator is malicious, given the evidence. isMalicious weights source signals by reliability, compares agreement and conflicts, and applies time decay to older observations.
Frequently asked questions
What is Confidence Score?
A confidence score quantifies how certain a threat intelligence system is that an indicator is malicious, given the evidence. isMalicious weights source signals by reliability, compares agreement and conflicts, and applies time decay to older observations.
How is Confidence Score related to Threat Intelligence?
Threat Intelligence in short: Threat intelligence is evidence-based knowledge about cyber threats, including observed infrastructure, behaviors, campaigns, and likely intent. It combines source observations with context so security teams can make a specific detection, triage, containment, or response decision.
Related terms
Threat Intelligence
Threat intelligence is evidence-based knowledge about cyber threats, including observed infrastructure, behaviors, campaigns, and likely intent. It combines source observations with context so security teams can make a specific detection, triage, containment, or response decision.
Threat Feed
A threat feed is a structured, continuously updated stream of IOCs and threat data from a single source or aggregator. Security tools ingest threat feeds to keep blocklists and detection rules current. Examples include Spamhaus DROP, abuse.ch URLhaus, and CISA KEV.
IOC (Indicator of Compromise)
An indicator of compromise is an indicator supported by evidence of compromise or malicious activity. Security teams use IOCs to detect, contain, and investigate threats; an arbitrary IP address, domain, URL, file hash, or email address is only an observable until evidence supports that promotion.
Try it on a real indicator
Look up any IP, domain, URL or file hash in the indexed records.