Security teams receive a constant stream of indicators of compromise (IOCs): IP addresses, domains, file hashes, and threat-report text from open and commercial feeds. Manually triaging this volume does not scale, which is the same scale argument from Unit 1, applied to intelligence rather than detection.
ioc_relevance_scorer.py
from sklearn.feature_extraction.text import TfidfVectorizer
from sklearn.linear_model import LogisticRegression
# historical_reports: threat-intel report text; relevant: 1 if it matched
# a past incident relevant to this organisation's own stack, else 0
vectorizer = TfidfVectorizer(stop_words="english", max_features=3000)
X_hist = vectorizer.fit_transform(historical_reports)
triage_model = LogisticRegression(max_iter=2000, class_weight="balanced")
triage_model.fit(X_hist, relevant)
def score_new_report(text: str) -> float:
vec = vectorizer.transform([text])
return float(triage_model.predict_proba(vec)[0, 1])
- Pull new reports from every subscribed feed (commercial, open-source, internal incident write-ups) on a schedule.
- Deduplicate near-identical reports describing the same underlying campaign, commonly done with the same TF-IDF vectors used for scoring, via cosine similarity above a chosen threshold.
- Score each report for relevance with the classifier above, trained on this organisation's own historical incident labels, not a generic public model.
- Extract structured indicators (hashes, domains, IPs) from high-relevance reports with pattern matching, then cross-reference them against internal logs automatically.
- Route only the reports that scored both relevant and produced a positive internal match to a human analyst; this is the same precision-over-recall judgement call this unit has made throughout, now applied to an analyst's limited attention instead of a firewall rule.
Case study: Why Automation Does Not Remove the Analyst
The triage pipeline above does not replace a threat intelligence analyst; it changes what the analyst spends their day on. A manual process that reads every incoming report in arrival order spends equal attention on a routine vendor advisory and a campaign actively targeting this organisation's own technology stack. An automated relevance score lets a small team read the five most relevant reports of the day first, deeply, rather than skimming fifty reports shallowly, the same triage-not-replacement argument Unit 2 made about low-confidence malware predictions being routed to a human rather than auto-actioned.
Try it yourself: Build a Tiny IOC Relevance Scorer
Collect the text of ten recent public threat-intelligence blog posts (from any vendor's published research blog). Label each one 1 if it mentions a technology your own lab environment uses, 0 otherwise. Train the pipeline above on even this small set and inspect which words the model weighted most heavily; this is the same feature-importance discipline from Unit 5, applied to triage instead of detection.