A computer-implemented method comprising: identifying, by a management and process orchestration server, a compromise to a system; performing, by the management and process orchestration server, a snapshot of the system and, based at least in part on the snapshot, identifying one or more potential indicators of compromise, wherein each of the potential indicators of compromise is associated with a system process or a presence of a file on the system; determining, by the management and process orchestration server, that one or more potential indicators of compromise are potential threat indicators, wherein the determining is based on matching the potential indicators of compromise with stored security threat information; for each potential indicator of compromise that is a potential threat indicator: identifying one or more corresponding actions performed by the system, comprising identifying actions related to one or more of process spawning, file access or modification, or registry access or modification; determining a credibility of each action performed by the system, comprising determining a credibility score for each action in regard to the system process, wherein an action of modifying a registry value has a low credibility value and the action of modifying a file has a high credibility value; determining, by a indicator analytics server, a composite credibility of the potential indicator of compromise, based on the credibility of each action; and determining, by the indicator analytics server, that the potential indicator of compromise is an actual threat indicator, based on the composite credibility. identifying, by a management and process orchestration server, a compromise to a system; performing, by the management and process orchestration server, a snapshot of the system and, based at least in part on the snapshot, identifying one or more potential indicators of compromise, wherein each of the potential indicators of compromise is associated with a system process or a presence of a file on the system; determining, by the management and process orchestration server, that one or more potential indicators of compromise are potential threat indicators, wherein the determining is based on matching the potential indicators of compromise with stored security threat information; for each potential indicator of compromise that is a potential threat indicator: identifying one or more corresponding actions performed by the system, comprising identifying actions related to one or more of process spawning, file access or modification, or registry access or modification; determining a credibility of each action performed by the system, comprising determining a credibility score for each action in regard to the system process, wherein an action of modifying a registry value has a low credibility value and the action of modifying a file has a high credibility value; determining, by a indicator analytics server, a composite credibility of the potential indicator of compromise, based on the credibility of each action; and determining, by the indicator analytics server, that the potential indicator of compromise is an actual threat indicator, based on the composite credibility. identifying one or more corresponding actions performed by the system, comprising identifying actions related to one or more of process spawning, file access or modification, or registry access or modification; determining a credibility of each action performed by the system, comprising determining a credibility score for each action in regard to the system process, wherein an action of modifying a registry value has a low credibility value and the action of modifying a file has a high credibility value; determining, by a indicator analytics server, a composite credibility of the potential indicator of compromise, based on the credibility of each action; and determining, by the indicator analytics server, that the potential indicator of compromise is an actual threat indicator, based on the composite credibility.