Normalise IOC scores on ingest

Overview

This playbook automatically assigns a priority score to Indicators and Observables as they are created in OpenCTI by a specified feed or connector. Rather than relying on the default score assigned at ingestion, it allows analysts to define per-type scores that reflect their organisation's trust level in a particular source. It is intended for use with high-confidence or well-understood feeds where consistent, type-differentiated scoring is desirable.

Dependencies

Trusted feed connector A connector or feed must be active and ingesting Indicators or Observables. The start component needs to have a creator set to complete the setup.

How to use it

Import and Configure In OpenCTI, navigate to Automations → Playbooks and select Import. Upload the playbook JSON file.

Once imported, open the playbook and locate the trigger node: Listen for IOC creation from your chosen feed.

Edit the trigger and replace the placeholder value REPLACE-WITH-TRUSTED-FEED-CREATOR-ID with the creator of your target feed or connector.

Review the default score values in each of the five scoring nodes. Adjust any scores to match your organisation's priority scale before activating.

Node IOC Type Default Score Set Hash Score StixFile (hashes) 95 Set IP Score IPv4-Addr, IPv6-Addr 95 Set Domain Score Domain-Name 85 Set URL Score URL 80 Set Email Score Email-Addr 75

Activate Once the creator_id placeholder has been replaced and scores reviewed, activate the playbook using the toggle in the playbook detail view. No ongoing manual interaction is required. The playbook runs automatically on each qualifying creation event.

Expected outcome

Once active, every new Indicator or Stix-Cyber-Observable created by the configured feed will be processed by the playbook. The x_opencti_score field on each entity will be updated to the value defined in the corresponding scoring node, based on its type.

You can confirm the playbook is working by:

Checking the Playbook execution history for successful runs after new IOCs are ingested. Opening a recently ingested Indicator or Observable from the target feed and verifying the Score field reflects the expected value from the table above.

Additional detail

Entities whose type does not match any of the five configured branches (e.g. an Account or Certificate observable) will pass through the trigger but will not have their score modified, as no matching scoring node exists for them.