Indicator Management

Definitions

1. The process of collecting, validating, normalizing, distributing, aging out, and acting on threat indicators across security tools and teams. Strong indicator management matters because stale or low-quality indicators create noise and blind spots at the same time.

   In plain English: Organizing and maintaining threat indicators so they stay useful.

   Example: "The SOC improved indicator management by expiring old domains automatically instead of keeping them in blocklists forever."

Related Terms

• Honeypot
• Alert Fatigue
• Attack Playbook
• CTI
• Emergency Access
• Hybrid Attack
• Incident Handler
• Intelligence Sharing
• IOC
• IP Intelligence
• Javelina