ThreatFilter — IOC triage worksheet
Guide: https://threatfilter.dev/guides/validate-iocs/
Keep completed copies in your approved internal case system. Do not upload them to ThreatFilter.

Indicator and type / hash algorithm:
Original source and report URL:
Source observation dates and timezone (or unknown):
Dataset generation date and coverage:
Search period, timezone, logs and collection gaps:
Local sightings and evidence identifiers:
Corroborating telemetry:
Legitimate alternatives / false-positive checks:
Assessment and uncertainty:
Decision and business impact:
Enforcement scope, rollback owner and review/expiry date:
Follow-up and reviewer:

A public indicator match is a lead, not proof of compromise or attribution.