Threat indicators are ingested from a feed. What metadata and lifecycle should the SOC consider?

1. Use only the longest indicator string
2. Treat every historical indicator as permanently definitive
3. Indicator type, source confidence, validity, expiration, and relevant context
4. Remove timestamps to simplify matching