IOC Match Rate Calculator
Measure how much of your threat-intel indicator set ever fires, how precise the matches are, and how much feed decay costs.
Inputs
Commodity domains and IPs decay within days to weeks; hashes last longer.
A user-supplied assumption.
Indicator Hit Rate
0.0720%
Share of the indicator set that ever matched anything.
Match Precision
1.52%
Matches per Million Events
3.625matches/M
Indicators Still Useful
162,500indicators
Matches That Were Not Malicious
1,428matches
Feed Cost per True Positive
$2,727
Feed Value Verdict
Poor value — most matches are noise; stop alerting on this feed directly
Step by step
Values used
Indicators in the active set = 250,000 indicators; Distinct indicators that matched = 180 indicators; Match events raised in the period = 1,450 matches; Matches confirmed malicious = 22 matches; Events evaluated against the set = 400,000,000 events; Indicators past their useful life = 35 %; Annual cost of the intel feeds = 60,000 $/year
IOC Match Rate
Indicator hit rate = distinct indicators matched ÷ indicators in the set. Match precision = confirmed malicious matches ÷ total match events.
Decay and cost
Effective indicators = set size × (1 − stale share); feed cost per true positive = annual feed cost ÷ confirmed matches.
Indicator Hit Rate
= 0.0720
Match Precision
= 1.52
Matches per Million Events
= 3.625 matches/M
Indicators Still Useful
= 162,500 indicators
Matches That Were Not Malicious
= 1,428 matches
Feed Cost per True Positive
= 2,727
How it works
Hit rates on large commodity feeds are typically far below 1%, which is expected rather than alarming: most indicators describe infrastructure you will never be targeted by. The number that decides whether to alert on a feed is precision — what share of matches were real — combined with cost per true positive. Indicator feeds are bought by volume and consumed by relevance, and a quarter-million-indicator subscription producing twenty-two real detections a period is a spend decision disguised as a security control.
Formulas
IOC Match Rate
Indicator hit rate = distinct indicators matched ÷ indicators in the set. Match precision = confirmed malicious matches ÷ total match events.
- indicators matched
- Distinct indicators that fired at least once
- match events
- Total alerts produced by indicator matching
- true positives
- Matches that turned out to be real
Decay and cost
Effective indicators = set size × (1 − stale share); feed cost per true positive = annual feed cost ÷ confirmed matches.
- stale share
- Indicators past their useful life — high for IPs and domains
- feed cost
- A user-supplied assumption
Frequently Asked Questions
How is IOC Match Rate calculated?
Indicator hit rate = distinct indicators matched ÷ indicators in the set. Match precision = confirmed malicious matches ÷ total match events. Hit rates on large commodity feeds are typically far below 1%, which is expected rather than alarming: most indicators describe infrastructure you will never be targeted by. The number that decides whether to alert on a feed is precision — what share of matches were real — combined with cost per true positive.
Why does IOC Match Rate matter?
Indicator feeds are bought by volume and consumed by relevance, and a quarter-million-indicator subscription producing twenty-two real detections a period is a spend decision disguised as a security control.
What values do I need to enter?
This calculator takes 7 inputs: Indicators in the active set, Distinct indicators that matched, Match events raised in the period, Matches confirmed malicious, Events evaluated against the set, Indicators past their useful life, Annual cost of the intel feeds. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Should low-confidence indicators alert at all?
No. Use them as enrichment — tag the event, raise the risk score, make them searchable — and reserve alerting for high-confidence, recently observed indicators tied to a specific campaign. This alone removes most intel-driven noise.
Why does indicator decay matter so much?
Because commodity IPs and domains rotate in days. Matching against expired indicators produces stale hits on infrastructure now hosting something innocuous, which is precision loss you pay for in analyst time. Enforce a TTL and age indicators out automatically.