What goes wrong when you feed IOCs into a SIEM

Contents

An indicator list does not gain value as it grows. Context-free IOCs create work for analysts and become a closed loop of noise.

Standing up an IOC feed is technically easy. Making the list useful to an analyst is the hard part.

Three common problems

No expiry. An IP used in a campaign six months ago may belong to a legitimate provider today.
No context. A "malicious" label alone does not produce action. The analyst wants to know which actor, which campaign and at what confidence.
No source separation. If the same indicator from different sources collapses into one record, you cannot tune confidence per source.

Before feeding an indicator, define: type, value, first seen, last seen, source, confidence, related actor or campaign, and validity period.

Without these the list may work as a blocklist, but it is not intelligence.

IOC MITRE ATT&CK

InsightGuard CTI Ekibi

Threat Intelligence Team

The InsightGuard research team, responsible for collection infrastructure, actor tracking and report production.