Beginner tip I learned: Always check the 'first seen' date on IOCs

I've been integrating Mandiant's IOCs into our security monitoring for a few months now, and I just had a moment that made me slap my forehead. I wanted to share it here, especially for others just starting out.

I was setting up a new automated enrichment workflow, pulling IOCs via their API into our SIEM. I created a rule to alert on any hits, thinking I was building a solid early warning system. Then, last week, we got a flurry of alerts on some IP addresses. The team scrambled, only to find out they were related to a campaign that was **five years old**. The IOCs were technically still "malicious," but not exactly relevant for immediate threat hunting.

The key lesson? **Always, always check the `first_seen` date** on the IOC object. Mandiant includes this field, and it's a game-changer for prioritizing what you actually act on. Now, my ingestion script filters out anything seen before, say, the last 90 days for our high-fidelity alerting. The older stuff goes to a separate dashboard for historical context.

Here's a snippet of the simple filter logic I added to my Python ingestion script:

```python
# Sample logic after fetching IOCs
for indicator in indicators_data:
first_seen = indicator.get('first_seen')
# Parse date and compare
if first_seen and is_recent(first_seen, days=90):
# Send to high-priority alert queue
process_for_alerting(indicator)
else:
# Log for historical/reporting purposes
archive_indicator(indicator)
```

This one check saved us from alert fatigue and lets the team focus on current, active threats. It seems obvious in hindsight, but it's an easy detail to miss when you're first setting up the pipeline. How do you all handle IOC prioritization and aging in your workflows?