A detonation quickly produces hundreds of paths, keys, and strings. Block all of them and you create a flood of false positives; ignore too much and you miss the real indicator. The new analyst triage layer in the SecTepe Sandbox solves this dilemma: it sorts every indicator by operational value – and delivers the reason with it.
Three Confidence Tiers With Evidence
Every normalized report gets two additional fields (existing consumers stay unchanged): ioc_confidence and score_breakdown. The indicators are sorted into three levels:
high_confidence– alertable on its own: contacted domains, routable destination IPs, full URLs, sample hashes, GUID/high-entropy mutexes.behavioral– meaningful only in combination: domains extracted from strings only, host-root URLs, staging paths, autorun keys.low_specificity– context, never a standalone detection: system directories, private IPs, generic tokens.
Each entry carries an evidence reason, such as "resolved or contacted during detonation". The underlying principle is clear: a domain in the DNS/HTTP traffic was contacted; one scraped from strings is merely present. This difference decides alertability.
A Score That Explains Itself
The score_breakdown field delivers a value from 0–100 across six capped categories (e.g. execution_behavior capped at 25). Each category names the signatures that fed it and its own evidence level. The honest framing matters: it is an evidence-weighted triage score, not a malware probability. It says "this is how robust this finding is", not "this is how likely malware is" – a difference that decides trust in the SOC.
Together With Real FP and Performance Fixes
The triage layer didn't arrive alone: behavioral signatures are scoped to the sample to avoid false positives on clean files; a truncation-aware baseline and bounded behavioral scoring ensure that even large detonations finalize cleanly. This makes prioritization not just smarter but also more reliable.
The Final Step of the Analysis Chain
Triage stands at the end of the CTI chain: the agentless sandbox produces the raw data, the agentic layer makes it queryable – and the analyst triage tells the analyst what to look at first and why. The malware-analyst skill was extended accordingly.
Conclusion
Confidence tiers with evidence and an explainable, honestly named score turn an unsorted IOC flood into an action-guiding priority list. That is exactly what a SOC needs when it has to work the right indicators first with limited time – without getting lost in false positives.