Lion Cipher Lab
Build an IOC confidence-scoring and aging pipeline
- Threat Intel Analyst
- Advanced
- ~75 min
- Free · no account required
Why it matters
A threat feed is not truth -- it is a stranger's claim, of unknown reliability, about an indicator that may already be dead. Pipe a raw feed straight into your blocklist and two things go wrong fast: you drown (thousands of low-fidelity indicators, most of them stale, burying the few that matter), and you self-inflict outages (a feed includes 8.8.8.8 or your own CDN and now you have blocked Google DNS or your own site). Every serious CTI platform -- MISP above all -- solves this with machinery most analysts never see: it SCORES each indicator's confidence, DECAYS that score over time, and…
What you'll learn
- building the ENGINE of the intel lifecycle from scratch in Python -- the confidence-scoring and aging logic that platforms like MISP hide behind a UI -- rather than just operating one of those platforms
- normalizing and DEDUPLICATING indicators across feeds: refanging defanged IOCs (hxxp -> http, [.] -> .), canonicalizing domains/IPs/hashes, and merging the same indicator when three feeds spell it three different ways
- grading sources with the Admiralty (NATO) system -- reliability A-F for the source and credibility 1-6 for the information -- and turning that grade into a numeric source weight
- scoring confidence by FUSING three axes: source reliability, corroboration (an indicator seen in N independent feeds via a noisy-OR combination), and indicator TYPE fidelity (a file hash is higher-fidelity than an IP that could be shared hosting)
- separating CONFIDENCE from DURABILITY using the Pyramid of Pain: a hash is high-confidence but low-durability (trivial for the adversary to rotate), an IP/domain is harder to change, so type sets BOTH the fidelity weight and the decay half-life
- aging indicators with a half-life decay curve and an expiry floor so stale IOCs drop out automatically -- the same idea as MISP's decaying-of-indicators / sightings model
- emitting a scored, ranked CSV/JSON export with an ALLOW-LIST guard that refuses to publish RFC1918 space, your own infrastructure, or well-known-good hosts, because a false positive that blocks your own DNS is worse than a miss
- naming the judgment: confidence != durability, decay-or-drown, corroboration beats any single source, an indicator with no expiry is a future false positive, and why you SIGHT rather than blindly trust a feed
Steps in this lab
- Why a feed you trust blindly is a liability
- The core idea: confidence is not durability (the Pyramid of Pain)
- Grading the source: the Admiralty system and corroboration
- Aging it: half-life decay, expiry, and the MISP model
- Set up: confirm Python and make a folder
- Create the three synthetic feeds
- Build the pipeline: normalize, dedup, score, decay, guard, export
- Run it and read the ranked output
- The allow-list guard: why a self-block is worse than a miss
- The judgment: sight, don't trust; decay or drown; corroborate
- What you built -- and the reflex to keep