You identified a new threat actor group with several IOCs in GTI and want to use some IOCs in several SecOps detection rules. Most effective approach?

• A. Update each rule's YARA-L logic to reference the threat actor group.
• B. Add IOCs to a new/existing reference list and update rule logic to include the list.
• C. Save IOCs in a new GTI collection and share.
• D. Configure a new data feed in SecOps with IOCs and update rules.

Answer: (B)

Centralizing IOCs in a reusable reference list lets multiple detection rules share the same data without duplicating it. By adding the threat actor’s IOCs to a new or existing reference list and updating the rule logic to check against that list, you create a single source of truth. When IOCs change or expand, you update the list once and all rules automatically apply the new indicators. This approach minimizes duplication, prevents drift between rules, and speeds up deployment of new indicators across the detection set.

Embedding IOCs directly inside each rule makes maintenance onerous and error-prone—every rule would need to be updated individually, increasing the risk that some rules diverge or miss new IOCs.

Using a GTI collection or a separate data feed adds complexity and extra steps to connect those sources to rule logic. While useful for sharing data, they don’t provide the same straightforward, scalable reuse across many rules as a centralized reference list does.