Check an indicator’s origin, supporting evidence, independent confirmation, age, context and relevance to your systems before acting on it. A trusted publisher does not make every indicator current, and a technical artifact alone does not prove a claim. Treat an indicator as a lead until evidence and operational context justify a response—unless signs of active compromise require your incident-response process immediately.
What does an indicator actually tell you?
An indicator of compromise (IOC) is an artifact such as an IP address, domain, URL, file hash or email address associated with suspected or confirmed malicious activity. The artifact is not self-explanatory. Find the claim attached to it: was it observed as a command-and-control endpoint, used in a phishing lure, associated with shared hosting, seen only historically, or listed as an item to investigate?
As an Amazon Associate I earn from qualifying purchases.
Look for the report’s technical context and observation details. CISA’s AIS submission guidance says additional metadata and technical context help recipients make analytical decisions. An indicator without that context may still be worth checking, but it is a weaker basis for an automatic block.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Assess the source and the specific claim separately
Trace the indicator to its original publisher. If it arrived through a repost, aggregator, screenshot or chat message, identify where it first appeared and how it was collected. Consider the publisher’s access to evidence, track record and consistency—but do not use brand recognition as a substitute for evaluating the particular claim.
CERT-EU’s Cyber Threat Intelligence Framework, released 8 April 2026, adapts the NATO Admiralty Code to keep two judgments distinct:
- Source reliability: how dependable the source is, on a scale from A (completely reliable) to F (unreliable or untested).
- Information credibility: how well the particular information is supported, on a separate scale from 1 to 6.
A reliable organization can publish a claim whose current relevance is unclear; a plausible-looking artifact does not establish the publisher’s reliability. CERT-EU’s framework accepts A/B sources paired with credibility grades 1 or 2 for its own threat-intelligence products. That is an example of its internal standard, not a universal cutoff that every organization should adopt. As CERT-EU puts it, “Adhering to common norms for expressing confidence and uncertainties in CTI reporting ensures consistent interpretation, reduces miscommunication, and enhances the credibility and usability of our CTI products for Union entities.”
Rank #2
Look for corroboration, not repetition
Check whether your own telemetry shows the indicator in suspicious activity, whether an analyst has reviewed it, and whether another credible source independently supports the same claim. CISA’s AIS scoring framework describes checks for local observation, previous analyst verification and confirmation by other available sources. Its labels—such as “Confirmed,” “Probably True” and “Possibly True”—belong to CISA’s framework; they are not universal ratings.
Many feeds repeating the same entry may reflect copying from one original report, not independent confirmation. Check the provenance and evidence behind each report. If sources disagree, preserve that disagreement, lower confidence and seek the underlying observations rather than averaging scores as though they shared a common scale.
Rank #3
Check when, where and how the indicator was observed
Record first-seen and last-seen times, the reporting period and whether the activity is still associated with malicious behavior. Consider legitimate uses and shared infrastructure—including cloud services, shared hosting, dynamic IP addresses and content-delivery networks—before blocking an address or domain.
A 2025 joint advisory from CISA, NSA, FBI and partner agencies, Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System, warns that some listed IP addresses associated with activity from August 2021 to June 2025 may no longer be in use. It recommends investigating or vetting them before action such as blocking. An old listing is a reason to investigate, not proof that the address remains malicious today.
Decide whether the threat fits your environment
Compare the report’s described victim, sector, software, geography, suppliers and activity with your own systems and exposure. CERT-EU’s framework considers the wider constituency ecosystem, including providers, partners, software, systems, sectors and events. It also treats threat level as a judgment about criticality and proximity: its examples call for close monitoring and checks for medium threats, and verification and action without delay for high threats.
Recommended Free Tools
Balance the impact of a false positive against the cost of missing a real threat. NIST SP 800-150, Guide to Cyber Threat Information Sharing describes threat information more broadly than a flat list of indicators: it can include adversary tactics and procedures, suggested defensive actions and incident-analysis findings. That wider context can help you decide whether an artifact matters to your organization.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Match the response to confidence and urgency
Use a proportionate response. A poorly sourced, weakly corroborated or undated indicator may warrant analyst review or cautious monitoring rather than a broad, hard-to-reverse block. If an indicator matches suspicious activity in your environment and is independently supported, respond in proportion to the affected asset and threat.
Best Value
If there is evidence of active compromise, follow your incident-response procedures; do not wait for an indicator-scoring exercise to finish. For less urgent cases, document the source, claim, evidence, dates, context, confidence and reason for the chosen action. Reassess indicators as new observations arrive.
What sharing formats can—and cannot—establish
CISA’s archived AIS materials describe STIX for representing cyber-threat information and TAXII for automated exchange. These formats can help systems share structured data, but a format or transport mechanism does not prove that an indicator is true, current or relevant to your network. Check current CISA material before relying on archived implementation details.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
