An analyst receives a third-party feed of 5,000 IP addresses labeled as command-and-control infrastructure, with no confidence ratings and no dates. Before loading the addresses into firewall blocklists, what is the most important consideration?
Select an answer to reveal the explanation.
Short Explanation
IP addresses are like rented apartments — today's bad tenant moves out and a perfectly innocent one moves in. If you block a stale address forever, you'll be blocking someone's legitimate site. So you check the source's confidence and give every indicator an expiry date before it hits the firewall.
Full Explanation
Consuming threat intelligence means turning indicators into enforcement or detection without harming legitimate traffic. IP addresses are the most volatile indicator type: attackers rotate infrastructure quickly, cloud and hosting providers reassign addresses, and shared hosting places many benign sites behind one address. A feed with no confidence ratings or timestamps gives no basis to judge reliability or age, so loading it permanently risks blocking reassigned addresses and legitimate services. Sound practice is to evaluate the provider's reputation and methodology, prefer indicators with confidence and first-seen and last-seen data, set expiry or aging so entries fall off unless refreshed, and stage new feeds in monitoring before blocking. Firewalls accept many indicator formats, including simple lists and vendor feeds, so STIX conversion is not a prerequisite. Permanent blocking assumes infrastructure never changes hands, which is false for IP addresses. Sharing with an ISAC is a separate decision governed by handling markings and has no bearing on whether an organization can enforce an indicator. Exam caveat: hashes and domains age differently from IPs, and the pyramid of pain ranks IPs as trivial for attackers to change. Operational check: load the feed in alert-only mode, review hits against known business services, then enable blocking with a defined expiry.