Threat indicator analytics system

A system comprising:

• one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
• identifying a compromise to a system;
• performing a snapshot of the system and, based at least in part on the snapshot, identifying one or more potential indicators of compromise, wherein each of the potential indicators of compromise is based on one or more currently running or recently ended processes on the system;
• determining that one or more potential indicators of compromise are potential threat indicators, wherein the determining is based on matching the potential indicators of compromise with stored security threat information;
• for each potential indicator of compromise that is a potential threat indicator:
• identifying one or more corresponding actions performed by the system that have been initiated by the one or more currently running or recently ended processes on the system on which identifying the potential indicator of compromise was based;
• determining a credibility score of each action of the one or more corresponding actions performed by the system, wherein each action is associated with a particular credibility score in regard to the currently running or recently ended process which initiated the action;
• determining a composite credibility score of the potential indicator of compromise, by combining the determined credibility scores of each action;
• and
• determining that the potential indicator of compromise is an actual threat indicator, based on the composite credibility score.