Attackers spin up fresh infrastructure, tweak payloads, and abandon burnt domains faster than any threat intelligence team can manually keep up. Relying on static blocklists or manual indicator lookups leaves SOCs playing catch-up while analysts drown in repetitive triage.
To fix this, Deepwatch built an Automated Indicator Scoring Architecture directly into our Threat Intelligence Platform (TIP). By automatically enriching multi-source threat data, applying decay schedules, and enforcing allowlist safeguards, we now ingest and score indicators of compromise at scale and continuously, without overwhelming our SOC analysts with false positives.
The Real-World Impact: Doing the Heavy Lifting of ~24 Humans
Validating and scoring threat indicators at scale has historically been a tedious and time consuming bottleneck for threat intelligence teams. Proper validation of indicators means checking domain age, passive DNS resolutions, sandbox execution logs, certificate chains, and infrastructure across tens of thousands of observables and indicators every day.
Our automated indicator scoring now handles that. We estimate it processes a workload that would otherwise require roughly 24 full-time cyber threat intel analysts. By automating the triage, our threat intel team can focus on threat intelligence and research work that actually requires human judgment.
Multi-Dimensional Automated Enrichment Without the Noise
Instead of relying on simple “good vs. bad” blocklists or single vendor verdicts, our scoring evaluates indicators and observables across a plethora of enrichment sources:
- File Hashes: Evaluated using behavioral sandbox execution (checking for memory injection and persistence), digital certificate validation, and malware similarity profiling.
- IP Addresses: Contextualized with fraud risk metrics, passive DNS history, hosting provider reputation, and active scan telemetry.
- Domains & Subdomains: Checked against WHOIS registration age, SSL/TLS certificate authority trust, subdomain risk inheritance, and infrastructure co-location.
- URLs: Analyzed using web execution heuristics, payload entropy, high-risk file extensions, and open-redirect patterns.
The above examples are just the tip of the iceberg, our scoring strategy defines over 70 variables that can impact indicator scores. To keep the data relevant and timely, the engine includes automatic lifecycle management. Temporal decay schedules lower risk scores as infrastructure ages out, rescores indicators anytime we observe or re-ingest them, all while built-in checks keep shared CDNs and major cloud providers from accidentally inflating risk by applying scoring “discounts” based on a variety of attributes.
Fueling Dynamic Risk Scoring (DRS) & High-Fidelity Alerting
Threat intel is useless if it sits in a static database. The scoring engine feeds risk modifiers straight into the Deepwatch Dynamic Risk Scoring (DRS) engine in real time:
- Deeper Coverage: Millions of validated indicators flow directly into active detection logic.
- Instant Telemetry Context: When an indicator shows up in a customer log, its score immediately elevates the risk level of that specific event.
- High-Fidelity SOC Alerts: Indicators meeting strict, high-confidence threshold criteria automatically trigger targeted 1:1 alerts for immediate SOC investigation, maximizing speed to detection while eliminating analyst triage fatigue.
Integrating Active Response for Endpoint extends the value of automated indicator scoring by translating high-confidence detections directly into machine-speed containment. When automated indicator scoring is evaluated in DRS and elevates event risk in real time, security operations can move immediately from detection to automated mitigation based on customer-defined authorization matrices:
- Automated Threat Containment: High-fidelity alerts can instantly execute actions such as Host Isolation or Process Kill across supported EDR platforms (including CrowdStrike, Microsoft Defender, and SentinelOne) to stop threats before lateral movement occurs.
- Flexible Execution Tiers: Organizations can align response actions with their specific operational risk appetite using three distinct modes:
- Fully Autonomous Response: Delivers immediate, automated execution for high-confidence scenarios and off-hours threat containment.
- Approval-Based Response: Streamlines authorization by routing response approvals directly to analysts or customer approvers via real-time approval integrations.
- Monitor Mode (“What-If” Mode): Enables teams to simulate response workflows and preview potential containment outcomes without executing live actions.
Engineering Spotlight: From Strategy to Operational Reality
Taking automated indicator scoring from an ambitious strategy and framework into a resilient, high-throughput production engine was a major engineering effort. We want to give a special highlight to our amazing engineer, Zack Dohmen, who spearheaded this transformation.
Zack engineered custom connectors and scoring mechanisms directly within our TIP, tying together multi-source ingestion feeds, real-time enrichment logic, and automated decay workflows straight into our core detection pipeline. Thanks to his work, what started as a complex concept is now a live engine protecting customer environments 24/7/365.
Proactive, Intelligence-Driven Defense at Scale
Combining automated multi-dimensional indicator scoring with Dynamic Risk Scoring gives our SOC analysts the context they need most: fast, high-confidence threat detection without the alert fatigue. Our customers benefit from rapid high-confidence threat detection, automated containment, and real-time visibility into emerging threats tailored to their tech stacks.
↑
Share