> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Confidence Scoring

> How Reyhford scores ICS/OT indicators so analysts know what to prioritize.

Not every honeypot hit is equal. **Confidence** (0–100 in STIX) tells automation and analysts how much weight to give an indicator for blocking, hunting, or executive reporting.

## Model

After server-side attribution, confidence is derived from **server-observed** facts — not from fields a single node can invent in the payload.

| Signal                          | Source                                                 | Effect                          |
| ------------------------------- | ------------------------------------------------------ | ------------------------------- |
| Multi-sensor campaign           | Same `src_ip` across distinct **stamped** `sensor_id`s | **100**                         |
| Single-sensor honeypot sighting | One enrolled sensor                                    | **40**                          |
| Known research scanner          | `known_scanners_dict`                                  | Event **excluded** from STIX MV |

Payload `protocol` and `function_code` still enrich labels/MITRE/description. They do **not** raise confidence to 85–100 by themselves (that was feed-poisonable before mTLS attribution).

## How to consume scores

| Score band           | Suggested use                                                                 |
| -------------------- | ----------------------------------------------------------------------------- |
| 100 (multi-sensor)   | Auto-block candidates; CERT priority — usually needs customer + owned sensors |
| \~40 (single sensor) | Hunt / watchlists; do not treat as campaign-grade                             |
| Filtered scanners    | Not published as indicators                                                   |

Use `min_confidence` on the [Indicators search API](/api-reference/indicators/search) and filter in your TIP/SIEM.

Related: [IoCs](/fundamentals/iocs).