What it does. Tracks IOCs through discovery, enrichment/validation (VirusTotal, Shodan, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/performing-indicator-lifecycle-management/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-indicator-lifecycle-management, or copy the skill folder into ~/.claude/skills/performing-indicator-lifecycle-management/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-indicator-lifecycle-management/SKILL.md

SKILL.md (verbatim)

name: performing-indicator-lifecycle-management
description: Tracks IOCs through discovery, enrichment/validation (VirusTotal, Shodan,
  passive DNS), deployment to SIEM/IDS watchlists, hit-rate and false-positive monitoring,
  confidence-score decay, and automated expiration using MISP/OpenCTI and STIX. Use
  when building or maintaining a threat intelligence indicator lifecycle process,
  aging out stale IOCs, or reducing analyst fatigue from low-quality indicators.
domain: cybersecurity
subdomain: threat-intelligence
tags:
- threat-intelligence
- cti
- ioc
- mitre-attack
- stix
- indicator-lifecycle
- ioc-management
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-05
- DE.CM-01
- DE.AE-02
mitre_attack:
- T1591
- T1592
- T1593
- T1589

Performing Indicator Lifecycle Management

Overview

Indicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes for IOC quality assessment, aging policies, confidence scoring decay, false positive tracking, hit-rate monitoring, and automated expiration to maintain a high-quality, actionable indicator database that minimizes analyst fatigue and maximizes detection efficacy.

When to Use

• When conducting security assessments that involve performing indicator lifecycle management
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Python 3.9+ with pymisp, requests, stix2 libraries
• MISP or OpenCTI instance for indicator storage
• SIEM with IOC watchlist capabilities (Splunk, Elastic)
• Understanding of IOC types, confidence scoring, and TLP classifications

Key Concepts

Indicator Lifecycle Phases

1. Discovery: IOC first identified from threat intelligence, malware analysis, or incident response
2. Validation: IOC verified against enrichment sources (VirusTotal, Shodan)
3. Enrichment: Additional context added (WHOIS, passive DNS, threat actor attribution)
4. Deployment: IOC pushed to detection systems (SIEM, IDS, firewall)
5. Monitoring: Track hit rates, false positive rates, detection efficacy
6. Review: Periodic assessment of IOC relevance and accuracy
7. Retirement: IOC expired or removed based on aging policy

Confidence Decay

Indicator confidence decreases over time as adversaries rotate infrastructure. A time-based decay function reduces confidence scores automatically, ensuring old indicators do not generate excessive alerts. Typical half-life: IP addresses (30 days), domains (90 days), file hashes (365 days).

Quality Metrics

• Hit Rate: Percentage of deployed IOCs generating true positive alerts
• False Positive Rate: Percentage of IOC alerts that are benign
• Coverage: Percentage of known threat techniques with IOC coverage
• Freshness: Average age of active indicators in the database

Workflow

Step 1: Implement IOC Lifecycle State Machine

from datetime import datetime, timedelta
from enum import Enum

class IOCState(Enum):
    DISCOVERED = "discovered"
    VALIDATED = "validated"
    ENRICHED = "enriched"
    DEPLOYED = "deployed"
    MONITORING = "monitoring"
    UNDER_REVIEW = "under_review"
    RETIRED = "retired"

class IOCLifecycle:
    def __init__(self, ioc_type, value, source, initial_confidence=50):
        self.ioc_type = ioc_type
        self.value = value
        self.source = source
        self.confidence = initial_confidence
        self.state = IOCState.DISCOVERED
        self.created = datetime.utcnow()
        self.last_updated = datetime.utcnow()
        self.last_seen = None
        self.hit_count = 0
        self.false_positive_count = 0
        self.history = [{"state": "discovered", "timestamp": self.created.isoformat()}]

    def transition(self, new_state: IOCState, reason=""):
        self.state = new_state
        self.last_updated = datetime.utcnow()
        self.history.append({
            "state": new_state.value,
            "timestamp": self.last_updated.isoformat(),
            "reason": reason,
        })

    def apply_decay(self):
        """Apply confidence decay based on IOC type half-life."""
        half_lives = {"ip": 30, "domain": 90, "hash": 365, "url": 60}
        half_life = half_lives.get(self.ioc_type, 90)
        age_days = (datetime.utcnow() - self.created).days
        decay_factor = 0.5 ** (age_days / half_life)
        self.confidence = max(0, int(self.confidence * decay_factor))

    def record_hit(self, is_true_positive=True):
        self.hit_count += 1
        self.last_seen = datetime.utcnow()
        if not is_true_positive:
            self.false_positive_count += 1
            if self.false_positive_count > 3:
                self.transition(IOCState.UNDER_REVIEW, "Excessive false positives")

    def should_retire(self):
        max_ages = {"ip": 90, "domain": 180, "hash": 730, "url": 120}
        max_age = max_ages.get(self.ioc_type, 180)
        age_days = (datetime.utcnow() - self.created).days
        return age_days > max_age and self.hit_count == 0

Validation Criteria

• IOC lifecycle state machine transitions correctly between phases
• Confidence decay reduces scores based on IOC type half-life
• Hit rate and false positive tracking functional
• Aging policy automatically flags indicators for review/retirement
• Quality metrics dashboard shows IOC database health

References

• MISP Indicator Lifecycle
• STIX Indicator Valid From/Until
• IOC Quality Framework

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Indicator Lifecycle Management Report Template

Report Metadata

Field	Value
Report ID	CTI-YYYY-NNNN
Date	YYYY-MM-DD
Classification	TLP:AMBER
Analyst	[Name]
Confidence	High/Moderate/Low

Executive Summary

[Brief overview of key findings and their significance]

Key Findings

1. [Finding 1 with supporting evidence]
2. [Finding 2 with supporting evidence]
3. [Finding 3 with supporting evidence]

Detailed Analysis

Finding 1

• Evidence: [Description of evidence]
• Confidence: High/Moderate/Low
• MITRE ATT&CK: [Relevant technique IDs]
• Impact Assessment: [Potential impact to organization]

Indicators of Compromise

Type	Value	Context	Confidence

Recommendations

1. Immediate: [Actions requiring immediate attention]
2. Short-term: [Actions within 1-2 weeks]
3. Long-term: [Strategic improvements]

References

• [Source 1]
• [Source 2]

references/api-reference.md (verbatim)

API Reference — Performing Indicator Lifecycle Management

Libraries Used

• csv: Parse IOC feed CSV files
• re: Pattern matching for IOC extraction (IP, domain, hash, URL, email, CVE)
• pathlib: Read text reports for IOC extraction

CLI Interface

python agent.py extract --file threat_report.txt
python agent.py ingest --csv ioc_feed.csv
python agent.py expire --csv ioc_db.csv [--ttl 90]
python agent.py dedup --csv ioc_feed.csv
python agent.py report --csv ioc_db.csv [--ttl 90]

Core Functions

extract_iocs(text_file) — Extract IOCs from unstructured text

Regex patterns for: IPv4, domain, MD5, SHA1, SHA256, URL, email, CVE.

ingest_ioc_feed(csv_file) — Normalize IOC feed data

Auto-detects IOC type if not specified. Normalizes column names across feed formats.

check_expiration(ioc_db_file, ttl_days) — Identify expired indicators

Compares first_seen date against TTL threshold (default 90 days).

deduplicate_iocs(csv_file) — Merge duplicate IOCs

Groups by indicator value, tracks source attribution and occurrence count.

generate_lifecycle_report(csv_file, ttl_days) — Full lifecycle status

Combines ingestion, deduplication, and expiration into single report.

IOC Pattern Types

Type	Example
ipv4	192.168.1.1
domain	evil.example.com
md5	d41d8cd98f00b204e9800998ecf8427e
sha256	e3b0c44298fc1c149afbf4c8996fb924...
url	https://malware.example.com/payload
cve	CVE-2024-12345

Dependencies

No external packages — Python standard library only.

references/standards.md (verbatim)

Standards and Frameworks Reference

Applicable Standards

• STIX 2.1: Structured Threat Information eXpression for CTI data representation
• TAXII 2.1: Transport protocol for sharing CTI over HTTPS
• MITRE ATT&CK: Adversary tactics, techniques, and procedures taxonomy
• Diamond Model: Intrusion analysis framework (Adversary, Capability, Infrastructure, Victim)
• Traffic Light Protocol (TLP): Information sharing classification (CLEAR, GREEN, AMBER, RED)

MITRE ATT&CK Relevance

• Technique mapping for threat actor behavior classification
• Data sources for detection capability assessment
• Mitigation strategies linked to specific techniques

Industry Frameworks

• NIST Cybersecurity Framework (CSF) 2.0 - Identify function
• ISO 27001:2022 - A.5.7 Threat Intelligence
• FIRST Standards - TLP, CSIRT, vulnerability coordination

References

• STIX 2.1 Specification
• MITRE ATT&CK
• Diamond Model Paper
• NIST CSF 2.0

references/workflows.md (verbatim)

Indicator Lifecycle Management Workflows

Workflow 1: Collection and Analysis

[Intelligence Sources] --> [Data Collection] --> [Analysis] --> [Reporting]
        |                        |                   |               |
        v                        v                   v               v
  OSINT/HUMINT/SIGINT    Normalize/Enrich    Assess/Correlate  Disseminate

Steps:

1. Planning: Define intelligence requirements and collection priorities
2. Collection: Gather data from relevant sources
3. Processing: Normalize data formats and filter noise
4. Analysis: Apply analytical frameworks and correlate findings
5. Production: Generate intelligence products and reports
6. Dissemination: Share with stakeholders via appropriate channels
7. Feedback: Collect consumer feedback to refine future collection

Workflow 2: Continuous Monitoring

[Watchlist] --> [Automated Monitoring] --> [Change Detection] --> [Alert/Update]

Steps:

1. Define Watchlist: Identify indicators, actors, and topics to monitor
2. Configure Monitoring: Set up automated collection from relevant sources
3. Change Detection: Identify new or changed intelligence
4. Assessment: Evaluate significance of changes
5. Alerting: Notify stakeholders of significant intelligence updates
6. Archive: Store intelligence for historical analysis and trending

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.