A threat intelligence analyst wants to measure the quality of IOCs being consumed by the SIEM. Which metric most accurately reflects IOC quality in operational use?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you measure IOC quality by how well indicators catch real threats without flooding you with false positives, plus how fresh and specific they are. The total count, price, and contributor count don't tell you whether the indicators work in your SIEM.
Full Explanation
The ratio of true positive alerts generated by IOC matches versus false positives, combined with IOC age and specificity, best reflects IOC quality in operational use because IOC quality is measured operationally by how accurately indicators detect real threats (true positive rate), how often they generate noise (false positive rate), how current they are (age), and how specific versus generic they are; high-quality IOCs have high true-positive rates with low false positives. The total number of IOCs in the threat intelligence feed is wrong because volume of IOCs does not indicate quality; many feeds contain large numbers of stale or low-fidelity indicators. The price paid for the commercial threat intelligence subscription is wrong because cost is a commercial factor; expensive feeds can still contain poor-quality indicators. The number of organizations that contributed IOCs to the sharing platform is wrong because contributor count reflects the crowd-sourced nature of a platform but not the accuracy or relevance of individual indicators.