Confidence Scoring - Reyhford Threat Intelligence

Not every honeypot hit is equal. Confidence (0–100 in STIX) tells automation and analysts how much weight to give an indicator for blocking, hunting, or executive reporting.

Model

After server-side attribution, confidence is derived from server-observed facts — not from fields a single node can invent in the payload.

Signal	Source	Effect
Multi-sensor campaign	Same `src_ip` across distinct stamped `sensor_id`s	100
Single-sensor honeypot sighting	One enrolled sensor	40
Known research scanner	`known_scanners_dict`	Event excluded from STIX MV

Payload protocol and function_code still enrich labels/MITRE/description. They do not raise confidence to 85–100 by themselves (that was feed-poisonable before mTLS attribution).

How to consume scores

Score band	Suggested use
100 (multi-sensor)	Auto-block candidates; CERT priority — usually needs customer + owned sensors
~40 (single sensor)	Hunt / watchlists; do not treat as campaign-grade
Filtered scanners	Not published as indicators

Use min_confidence on the Indicators search API and filter in your TIP/SIEM. Related: IoCs.