Every second a raw indicator (IOC) streams in from a source with its own reliability. Analysis + enrichment add a fixed confidence boost, then the indicator's confidence decays exponentially with a tunable half-life — exactly the TTL policy a real threat-intel platform (TIP) applies so stale indicators stop firing. Only indicators whose current confidence clears your threshold sit inside the glowing "active detection" shell; everything else has decayed below it and is inert space-junk.
confidence(t) = (base + enrichment) · 0.5^(t / half_life)
active ⇔ confidence(t) ≥ threshold
Attack probes spawn continuously and fly toward the core. A probe is blocked only if it matches a currently-active indicator; unmatched probes reach the core as a breach. A noisy feed also injects indicators with a spoofed source: if one of those clears your threshold it fires as a false positive on legitimate traffic.
- Detection threshold — raise it and false positives vanish, but real indicators decay out of range sooner, so more attacks slip through; lower it and you block more, at the cost of chasing noise.
- TTL decay half-life — how long an indicator stays trustworthy. Short half-lives (fast-moving campaigns, IPs) demand constant re-collection; long half-lives (malware hashes, TTPs) stay useful for a while.
- Enrichment boost — the confidence you buy by correlating a raw indicator against sandbox results, WHOIS, passive DNS and other context before it reaches the threshold.
- Feed noise ratio — the share of incoming indicators from a low-quality or spoofed source; higher noise inflates the false-positive count at any fixed threshold.
Real-world relevance: this is the collection → enrichment → scoring → dissemination loop threat-intel teams run every day, and the threshold/half-life tradeoff is exactly what determines whether a TIP's automated detections help the SOC or drown it in noise.