Indicator Aging
Indicator aging is the process of reducing confidence or removing stale IOCs from blocklists as infrastructure is retaken, sinkholed, or reassigned. Without aging, blocklists accumulate false positives and block legitimate services on recycled IPs.
Frequently asked questions
What is Indicator Aging?
Indicator aging is the process of reducing confidence or removing stale IOCs from blocklists as infrastructure is retaken, sinkholed, or reassigned. Without aging, blocklists accumulate false positives and block legitimate services on recycled IPs.
How is Indicator Aging related to False Positive?
False Positive in short: A false positive in threat intelligence is a benign indicator incorrectly classified as malicious. High false positive rates waste analyst time and cause legitimate traffic to be blocked. isMalicious uses multi-source correlation and reliability weighting to minimize false positives below 0.1% for high-confidence verdicts.
Related terms
False Positive
A false positive in threat intelligence is a benign indicator incorrectly classified as malicious. High false positive rates waste analyst time and cause legitimate traffic to be blocked. isMalicious uses multi-source correlation and reliability weighting to minimize false positives below 0.1% for high-confidence verdicts.
Blocklist (Denylist)
A blocklist is a list of IPs, domains, URLs, or file hashes known to be malicious. Firewalls, DNS resolvers, and email gateways use blocklists to automatically block traffic from known bad actors. Blocklists must be kept current to remain effective.
Confidence Score
A confidence score quantifies how certain a threat intelligence system is that an indicator is malicious, given the evidence. isMalicious weights source signals by reliability, compares agreement and conflicts, and applies time decay to older observations.
Try it on a real indicator
Look up any IP, domain, URL or file hash in the indexed records.