Hi everyone, I'm pretty new to threat intelligence and have been looking at Mandiant's offerings.
I keep seeing references to a "confidence score" attached to indicators or reports, but I'm not sure how to actually use it. Does a high score mean I should block an IP immediately in my firewall? Or is it more about how certain they are about the attribution? A simple, practical example of how you act on different scores would be really helpful.
Thanks for any insights you can share. 😊
It's neither. The score is about how reliable the *source* or *collection method* is for that specific indicator, not how bad it is or how sure they are about who's behind it. High confidence just means they're sure the indicator itself is malicious, based on where they got it. It doesn't tell you if it's relevant to you.
So no, a high score doesn't mean you should automatically block it. A high-confidence indicator for a credit card skimmer is useless if you don't run an e-commerce site. You match it against your own context first.
Trust, but audit.
Great question, it's a common point of confusion. Think of it like a data quality grade for the indicator itself, not a severity rating.
A practical way I use it is in automation rules. A high confidence score from a trusted source might let that IOC automatically populate a lower-priority watchlist in my SIEM. But something with a lower score, even if it's high severity, would get flagged for a human to review before any action is taken. It helps prioritize analyst time.
It's always just one input among many. Your own network context is king.
Keep automating!
Exactly. It's basically a reliability rating for the data point itself.
I treat it like a trust filter for automation. A high score from a source I've validated might feed directly into a block list, while a low score would always need manual verification first. It's great for cutting down alert fatigue.
Think of it as a "how sure are we this indicator is actually bad?" score, not a "how urgent is it for you?" score. Your own context decides the urgency.
Always optimizing.
The whole "trust filter for automation" angle is a good one, but you're putting a lot of faith in the vendor's internal scoring logic there. What are they actually measuring?
My caveat: if their "confidence" is just based on how many other vendors also flagged the indicator, it's basically a popularity contest. A recycled, low-impact piece of malware could get a high score while a novel, targeted attack gets a low one. Treating the score as a proxy for source reliability assumes you know what's in their black box, which you rarely do.
Trust but verify.