A 9,400-indicator ISAC feed and a board metric that rewards volume

Framing. An indicator's worth is a function of durability, false-positive cost, and whether you own a sensor that can actually see it. The event-level label "high confidence" does not transfer to the 9,400 rows; it describes the campaign, not each hash.

Score every class before ingesting:

• File hashes (7,800). A hash dies the moment the loader is rebuilt. The 31/40 packer sample means most of these are setup-builder artefacts shared by half the retail software on earth - blocking them creates outages and gains nothing. Action: run a read-only live-search sweep of the hash list against the EDR estate (query only, no block). Any hit gets investigated as a file of interest. Keep only the minority that are unpacked, unique, or low-prevalence for blocklist import; that is typically a few hundred at most.
• Domains (1,200). Re-resolve and classify. Parked and sinkholed entries go straight to the TIP as "expired", not to the proxy. Retain newly registered, non-CDN, non-parked entries with technical corroboration (matching URI path, JA3, or certificate pattern) as detection content rather than bare FQDN blocks.
• IPs (60). CDN anycast addresses are shared by thousands of tenants. Blocking them is a self-inflicted denial of service. Reject for blocking; retain for enrichment and for retro-hunting in NetFlow/Zeek.

Output. A detection-ready subset in the low hundreds plus five to ten behavioural analytics derived from the campaign's techniques, not its infrastructure. Tag each record with technique, provenance, verification status and per-indicator confidence instead of inheriting the event score.

Sharing constraint. The redistributing prohibition means detection content stays internal, and TIP propagation rules must be checked so indicators are not auto-forwarded to any external SaaS or partner feed.

Confidence must be per indicator. Use a simple, auditable scheme: A = verified in-house (hit in your estate, or confirmed by two independent sources), B = single reputable source and technically consistent with the campaign's tooling, C = unverified or contradicted. Only A and B are actionable; C stays in the TIP for hunting.

TTL by volatility, not by policy default. The flat 90 days is the real defect:

• Campaign domains: 30 days with mandatory revalidation at day 14 (re-resolve; purge if sinkholed or parked).
• IPs: 7–14 days; infrastructure rotates faster than domains.
• Packer-artefact hashes: do not age out - reject at intake, because TTL cannot fix a false-positive rate.
• Unique malware hashes: 90–180 days, but flagged low-utility; their value is retrospective sweep, not prevention.

Automate revalidation so the queue does not grow: scheduled re-resolution, sinkhole check, prevalence check against the estate.

Answering the board. Report both numbers and explain the gap: 9,400 ingested, 9,400 evaluated, roughly 200 deployed as detections, and why the discarded items were discarded - an indicator that never fires because it is a legitimate vendor installer has negative value. Pair it with outcome metrics the board can reason about:

• detection rules derived from the event and the percentage of the estate they cover;
• true positives raised in the following 30 days attributable to the feed;
• median hours from publication to deployment;
• coverage gaps: high-risk techniques with no detection at all.

Keep an exclusions register with the reason for each rejection so the number is defensible in an audit and to the ISAC, and so a year later you can prove the decision was deliberate rather than lazy.

Rule one: block names, alert on addresses. A CDN IP block hits unrelated tenants; a name block hits only the destination the malware is configured to call. So:

• Enforce at the DNS layer first (RPZ or resolver sinkhole), because it catches every client regardless of protocol and gives you a hit count and the requesting host - which is also your detection telemetry. This matters because proxy FQDN blocking only works for proxied HTTP(S) traffic and, without TLS inspection, you are matching SNI at best; QUIC, DoH, and direct-IP fallback bypass it entirely.
• Wildcard with discipline. If the campaign uses DGA-like subdomains under one parent, block *.parent.tld; if the parent hosts legitimate SaaS, block exact names only and accept the risk of missing a rotation.
• IP blocks only as a scoped, time-boxed incident measure, when the destination is a dedicated hosting address (not a shared edge), the incident is live, and the block has an expiry and an owner. Document the exception.

Layer the defence, do not rely on the block. The same actor will rotate domains within days. Add behavioural detections that survive rotation:

• a non-browser process making outbound DNS or TLS (Sysmon 22 / EDR DNS events) to a newly registered domain;
• rare-process network egress from user-writable paths;
• beacon-periodicity analytics rather than destination matching.

Measure the cost. Track block-hit volume and any helpdesk tickets citing the blocked name in the 72 hours after deployment. If a block produces business tickets, that is a review trigger, not something to leave running until the TTL expires. Finally, confirm no indicator leaves the estate: check TIP propagation and any third-party enrichment API calls that would ship raw indicators outside the sharing group's terms.