Source entities of security indicators

A non-transitory machine-readable storage medium storing instructions executable by a processor of a computing device to cause the processor to:

• identify a first security indicator that is originated from a first source entity of a plurality of source entities in a security information sharing platform, wherein the first security indicator provides a warning of a first potential security threat and specifies a first address or domain name of the first potential security threat;
• determine a total count of sightings of the first address or domain mane of the first potential security threat as observed by the plurality of source entities in the security information sharing platform;
• determine a reliability level of the first source entity based on a first set of user feedback information including votes about accuracy of the first security indicator and the total count of sightings of the first address or domain name of the first potential security threat, wherein a higher number of votes about the accuracy of the first security indicator and a higher count of sightings of the first address or domain name of the first potential security threat result in a higher reliability level of the first source entity;
• determine a score of the first security indicator based on the reliability level of the first source entity;
• and
• compare the score of the first security indicator to at least one threshold value to determine whether the first security indicator is an actual security threat.

A system for source entities of security indicators comprising:

• a processor;
• and
• a memory storing instructions that are executable to cause the processor to:
• identify a security indicator that is originated from a first source entity of a plurality of source entities in a security information sharing platform, wherein the security indicator provides a warning of a potential security threat and specifies a particular address or domain name of the potential security threat;
• determine a total count of sightings of the particular address or domain name of the potential security threat as observed by the plurality of source entities in the security information sharing platform;
• determine a reliability level of the first source entity based on a set of user feedback information including votes about accuracy of the security indicator and the total count of sightings of the particular address or domain name of the potential security threat,
• wherein a higher number of votes about the accuracy of the security indicator and a higher count of sightings of the particular address or domain name of the potential security threat result in a higher reliability level of the first source entity;
• determine a score of the security indicator based on the reliability level of the first source entity;
• and
• compare the score of the security indicator to at least one threshold value to determine whether the security indicator is an actual security threat.