Lion Cipher Lab
Build an IOC decay and scoring pipeline from scratch
- Threat Intel Analyst
- Advanced
- 60-90 min
- Free · no account required
Why it matters
An IOC (indicator of compromise) - an IP, domain, file hash, or URL tied to an attack - is only useful while it still points at the adversary. Attackers rotate IPs and domains cheaply, so a blocklist that 'keeps every IOC forever' slowly fills up with addresses that now belong to innocent third parties, generating false positives and eroding trust in the whole feed. This lab builds the fix from scratch: a scoring model that decays indicators over time, decays cheap-to-rotate types faster than costly-to-change ones, and retires stale entries automatically - while showing, in real printed…
What you'll learn
- Model MISP-style decaying indicators in pure Python (no dependencies)
- Set type-specific half-lives using David Bianco's Pyramid of Pain
- Implement exponential decay, expiry thresholds, and sighting-based refresh
- Quantify false-positive reduction versus a keep-forever blocklist
- Recognize named failure modes and when NOT to auto-expire an indicator
Steps in this lab
- Understand the problem before you touch a keyboard
- Open a terminal and confirm Python is installed
- Create a clean working folder
- Write the pipeline script
- Run it and read the per-type decay
- Read the three measured payoffs
- Prove the pinned clock and inspect one score by hand
- Judgment: failure modes, why-this-not-that, and when NOT to expire