Manages IOC lifecycle in threat intelligence from discovery to retirement, with validation, enrichment, deployment, monitoring, confidence decay, hit/false positive tracking, and auto-expiration using Python state machine.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
指标生命周期管理跟踪 IOC 从初始发现到验证、富化、部署、监控和最终停用的全过程。本技能涵盖实施 IOC 质量评估、老化策略、置信度衰减评分、误报跟踪、命中率监控和自动到期的系统化流程，以维护高质量、可操作的指标数据库，最大限度减少分析师疲劳并提高检测效能。
Implements IOC lifecycle management from discovery to retirement, with validation, enrichment, confidence decay, and monitoring using Python, MISP, and STIX. For threat intelligence pipelines.
Implements IOC lifecycle management for threat intelligence: tracks indicators from discovery via validation, enrichment, deployment, monitoring to retirement with confidence decay, hit-rate tracking, and automated expiration.
Implements threat intelligence lifecycle management covering planning, collection, processing, analysis, dissemination, and feedback stages using Python with pymisp and stix2 for CTI programs.
Share bugs, ideas, or general feedback.
指标生命周期管理跟踪 IOC 从初始发现到验证、富化、部署、监控和最终停用的全过程。本技能涵盖实施 IOC 质量评估、老化策略、置信度衰减评分、误报跟踪、命中率监控和自动到期的系统化流程，以维护高质量、可操作的指标数据库，最大限度减少分析师疲劳并提高检测效能。
pymisp、requests、stix2 库指标置信度随时间降低，因为对手会轮换基础设施。基于时间的衰减函数自动降低置信度评分，确保旧指标不会产生过多告警。典型半衰期：IP 地址（30 天）、域名（90 天）、文件哈希（365 天）。
from datetime import datetime, timedelta
from enum import Enum
class IOCState(Enum):
DISCOVERED = "discovered" # 已发现
VALIDATED = "validated" # 已验证
ENRICHED = "enriched" # 已富化
DEPLOYED = "deployed" # 已部署
MONITORING = "monitoring" # 监控中
UNDER_REVIEW = "under_review" # 审查中
RETIRED = "retired" # 已停用
class IOCLifecycle:
def __init__(self, ioc_type, value, source, initial_confidence=50):
self.ioc_type = ioc_type
self.value = value
self.source = source
self.confidence = initial_confidence
self.state = IOCState.DISCOVERED
self.created = datetime.utcnow()
self.last_updated = datetime.utcnow()
self.last_seen = None
self.hit_count = 0
self.false_positive_count = 0
self.history = [{"state": "discovered", "timestamp": self.created.isoformat()}]
def transition(self, new_state: IOCState, reason=""):
self.state = new_state
self.last_updated = datetime.utcnow()
self.history.append({
"state": new_state.value,
"timestamp": self.last_updated.isoformat(),
"reason": reason,
})
def apply_decay(self):
"""根据 IOC 类型半衰期应用置信度衰减。"""
half_lives = {"ip": 30, "domain": 90, "hash": 365, "url": 60}
half_life = half_lives.get(self.ioc_type, 90)
age_days = (datetime.utcnow() - self.created).days
decay_factor = 0.5 ** (age_days / half_life)
self.confidence = max(0, int(self.confidence * decay_factor))
def record_hit(self, is_true_positive=True):
self.hit_count += 1
self.last_seen = datetime.utcnow()
if not is_true_positive:
self.false_positive_count += 1
if self.false_positive_count > 3:
self.transition(IOCState.UNDER_REVIEW, "误报过多")
def should_retire(self):
max_ages = {"ip": 90, "domain": 180, "hash": 730, "url": 120}
max_age = max_ages.get(self.ioc_type, 180)
age_days = (datetime.utcnow() - self.created).days
return age_days > max_age and self.hit_count == 0