A threat intelligence analyst receives an indicator of compromise (IOC) consisting of an IP address associated with a known botnet C2. The IOC is 6 months old. What factor most affects the reliability of this IOC?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — IP-based IOCs are low-fidelity and short-lived, so a 6-month-old IP address tied to botnet C2 often misses current infrastructure or triggers false positives. Attackers rotate IPs frequently, so fidelity and age drive reliability.
Full Explanation
The correct factor is IOC fidelity and age: IP-based IOCs are low-fidelity and short-lived; attackers frequently rotate IP addresses, making a 6-month-old IP IOC likely to produce false positives or miss current infrastructure. The number of threat actors associated with the botnet is wrong because it does not directly affect the current validity of a specific IP address. Sharing the IOC via STIX/TAXII format is wrong because the format improves automation but does not affect the validity of the underlying indicator. The TLP classification is wrong because it controls who can share the IOC, not whether the indicator is still accurate.