IoC Source Reliability Basis

B.RUATTA723613 — Sun, 25 May 2025 13:39:32 GMT

Hi Team,

On what basis this Reliability level is classified on Cortex XDR

Thank you

Re: IoC Source Reliability Basis

aspatil — Tue, 27 May 2025 09:27:06 GMT

This is something which you need to define. You may consider below:

An Indicator (like an IP address, file hash, domain, URL, or registry key) is assigned a reliability level based on factors such as:

Source of the Indicator:
Is it from a well-known, trusted threat intelligence provider? Or is it from an unverified source?
Verification Method:
Has the indicator been observed in multiple confirmed attacks, or is it just a one-time suspicion?
Recency and Frequency:
How recently was this indicator active, and how often does it appear in malicious contexts?
False Positive Rate:
Has this indicator been proven to cause false positives (i.e., appears in benign situations)?
Contextual Information:
Is the indicator tied to known malware campaigns, threat actor groups, or attack techniques?

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.