Sharing IoC - Wrong Answers Only

Deborah Servili, who works on MISP at CIRCL, improving taxonomies and galaxies and turning researcher reports into MISP events, explains that she often receives indicators of compromise shared in poor ways. Instead of showing real cases, she builds a set of harmless mock examples to illustrate the problems.

She walks through a series of increasingly awkward formats. A screenshot of an indicator list is split across two pages, so the content is no longer in one piece. A PDF is offered as an alternative, then an image that she runs through OCR, which introduces character errors that have to be fixed by hand. Compressing the picture to save space makes the text harder to read, and the final option is a video of a screen. Each step makes the data slower and less reliable to extract and verify.

The takeaway is that indicators should be shared as structured, machine-readable data rather than as pictures, documents or recordings. Manual extraction adds errors and slows ingestion into threat intelligence platforms. The talk ends with the speaker's social media contacts.