1
Threat Intelligence Management
hard
An engineer is configuring indicator expiration for a threat feed. The organization wants indicators from this feed to expire 30 days after they are last seen in the feed. The engineer sets the 'Expiration' parameter to 30 days on the feed instance. However, after 30 days, indicators are still present in the Threat Intel database. Which factor is most likely preventing the expiration from occurring?