Collaborative investigation of security indicators

A non-transitory machine-readable storage medium comprising instructions executable by a processor of a computing device for collaborative investigation of security indicators, the machine-readable storage medium comprising:

• instructions to cause a display of community-based threat information associated with a security indicator, the community-based threat information comprising a collaborative set of investigation results that is obtained from a plurality of users for the security indicator and an indicator score;
• instructions to obtain an investigation result indicating whether the security indicator is malicious;
• instructions to include the investigation result in the collaborative set;
• and
• instructions to determine the indicator score based on at least one parameter, the at least one parameter comprising the number of the investigation results in the collaborative set that indicate that the security indicator is malicious.

A system for collaborative investigation of security indicators comprising:

• a processor that:
• generates a security alert based on a detection of a security indicator in event data, wherein a blacklist comprises a plurality of security indicators;
• in response to the security alert, obtains community-based threat information associated with the security indicator, the community-based threat information comprising a plurality of investigation results that are obtained from a plurality of users for the security indicator and an indicator score that is determined based on the plurality of investigation results;
• obtains a new investigation result from a user, the new investigation result indicating whether the security indicator is malicious;
• modifies the indicator score based on the new investigation result;
• and
• determines whether to remove the security indicator from the blacklist based on the indicator score.