IOC enrichment and decay scoring.
Every Indicator of Compromise in Liberty91 carries two separate numbers, and reading them as one is the most common way to misread an indicator. The score says how much weight the indicator deserves right now, and it decays as the indicator ages. The confidence says how sure we are that the indicator is genuinely malicious, and it moves with evidence rather than with time. A fresh indicator from a thin report has a high score and low confidence; an indicator confirmed by three vendors two months ago has the opposite. Enrichment through your Modules is what supplies the evidence behind the second number.
Score: how much weight, right now
Liberty91 assigns each indicator a base score from 0 to 100 based on three factors:
- The type of indicator.
- The source it came from.
- The criticality of the threat it is associated with.
This approach follows the decaying-indicators research pioneered by the CIRCL team at MISP. See Source reliability and confidence for how source ratings feed into scoring.
How the score decays
The base score decays over time, measured from when the indicator was last seen. When the score falls below a threshold, the IOC expires. The default threshold is 30, and you can change it to suit your environment.
When an expired or decaying IOC is seen again, the time since last seen resets to zero and the decay countdown begins anew. A re-sighted indicator regains its standing rather than staying expired.
Confidence: how sure we are it is malicious
Confidence answers a different question: how sure are we that this indicator is genuinely malicious? It is not stored on the indicator and it does not decay. It is worked out each time you look, from whatever evidence exists at that moment, which means it moves the instant a new enrichment comes back.
It is built up like this:
- Start from how clearly the indicator was stated in the source. When Liberty91 extracts an indicator from a report, it records how unambiguously that report presented it. A hash listed in an IOC table reads very differently from one mentioned in passing in prose. That extraction confidence is the baseline. Where nothing was recorded but other signals exist, the baseline starts at 50.
- Add for each vendor that calls it malicious. Every distinct enrichment vendor returning a malicious verdict, such as VirusTotal, CrowdStrike, or AlienVault OTX, adds 15 points. Vendors are counted once each, so a single vendor reporting through two routes cannot inflate the number.
- Add a corroboration bonus. Once two or more distinct vendors independently agree the indicator is malicious, a further 5 points are added on top. Agreement between independent vendors counts for more than the sum of the individual opinions.
- Cap it hard if anything says benign. If any vendor reports the indicator as benign, confidence is capped at 20 regardless of how high the baseline was. A known-good indicator should never read as high-confidence malicious, even when a report listed it prominently.
The result is clamped to the 0 to 100 range. Where there is genuinely no signal, meaning nothing was recorded at extraction, no enrichment has returned, and the verdict is still unknown, the indicator shows a dash rather than a number. That dash means we have no basis for a judgement. It does not mean the indicator is safe.
The benign cap is deliberate and it overrides everything above it. If you see an indicator with a high score and a confidence of 20 or below, that is usually the cap in action: something in your enrichment stack has recognised it as known-good. Public DNS resolvers appearing in a proxy log are the classic case.
Verdict
Alongside the score and the confidence, each indicator carries a verdict, which is the plain classification the enrichment vendors have converged on.
| Verdict | What it means |
|---|---|
| Malicious | At least one vendor positively identifies the indicator as malicious |
| Suspicious | Vendors report something concerning without calling it outright malicious |
| Benign | A vendor recognises the indicator as known-good |
| Unknown | No vendor has an opinion on it yet |
The verdict takes the worst reading across the vendors that have an opinion, on the principle that one credible vendor calling something malicious matters more than several having never seen it. Verdict is also available as a filter on the IOC API.
Two rules govern how the vendor readings combine, and both matter if you filter or triage on the verdict.
Verdicts only escalate. The stored verdict is the worst reading across every enrichment vendor you have turned on. A vendor returning Benign later never overwrites a stored Malicious.
A quiet reading is not a clean bill of health. Some vendors deliberately return Unknown rather than Benign when nothing comes back. AbuseIPDB does so below 15% abuse confidence, and Censys does so whenever it finds no known malware families on a host, because "nobody has reported this" and "this is known good" are different claims. Do not build allow-listing on Unknown.
An indicator of a type a provider does not support gets nothing from that provider: no chip and no verdict, which is likewise not a judgement about the indicator.
Enrichment through Modules
Enrichment adds context to each indicator through the Modules you turn on. The vendors that can feed an indicator's verdict and confidence are AlienVault OTX, MISP, CrowdStrike, Google Threat Intelligence, VirusTotal, URLScan, GreyNoise, Shodan, AbuseIPDB, Censys, and ReversingLabs, alongside any verdict one of your own analysts records in the platform. Each provider answers on the indicator types it supports, so a hash and an IP address rarely come back with the same set of chips. When an indicator in an Event matches something one of these sources knows about, the platform surfaces the association and offers it to you as an Enrichment Opportunity. Accepting it records the association against the entity.
Enrichment is also what moves confidence. Each vendor that returns a verdict on an indicator becomes one of the independent voices in the calculation above, so the more enrichment Modules you have turned on, the more the confidence figure tells you.
Indicators that never make it in
Not everything that looks like an indicator is one. Well-known public infrastructure, such as the public DNS resolvers that appear in almost every network capture, is filtered out during extraction rather than being pulled in and then scored down. This is why an obviously benign address mentioned in a report does not turn up in the indicator list at all: it was excluded on the way in, and there is nothing to suppress later.
Frequently asked questions
How is an IOC's base score calculated?
From three inputs: the type of indicator, the source it came from, and the criticality of the threat it is associated with. The result is a base score from 0 to 100.
What is the difference between an IOC's score and its confidence?
The score reflects how much weight the indicator deserves right now, and it decays with age. Confidence reflects how sure we are the indicator is genuinely malicious, and it moves with enrichment evidence rather than with time. A fresh indicator can have a high score and low confidence, and an old one the reverse.
Why does an indicator show a dash instead of a confidence value?
Because there is no signal to compute one from: nothing was recorded about how clearly the indicator was stated in the source, no enrichment vendor has returned a verdict on it, and the verdict is still unknown. A dash means we have no basis for a judgement, not that the indicator is safe.
What happens when an IOC is seen again?
The time since last seen resets to zero and the decay countdown starts over, so a re-sighted indicator regains its standing rather than staying expired.