Threat Intel Confidence Pipeline

Raw indicators of compromise arrive continuously from feeds of varying quality. This simulator visualizes the pipeline that turns them into working detections: each indicator gets a base confidence from its source, an enrichment boost from correlation, and then decays exponentially on a TTL clock — exactly the "IOC decay" policy real threat-intel platforms enforce so stale indicators stop generating stale alerts. Only indicators whose live confidence still clears your detection threshold are armed to block matching attack traffic; everything else has aged out. Tune the threshold, decay half-life, enrichment strength and feed noise to see the real tradeoff intel teams live with — block more attacks, or drown the SOC in false positives.