Malware analysts are often asked to correlate IoCs retroactively. Recently correlated IoCs that went back to Chinese code from 2002 in 2016. Just a few months ago, we found meaningful IoCs that tied a threat commnunity to its predecessors from 2006. Without the ability to track all of these IoCs across the years, there would not have been a correlation.
There are also ways to grade IoCs:
Level 1 : SHA2 hashes, BGP ASNs, hostnames
Level 2 : MD5+SHA1 hashes, IPv4/IPv6 Prefixes
Level 3 : Mutex names, Imphashes
Level 4 : Yara rules
Level 5 : File, class, or block similarities (e.g., Icewater, GCluster.py, TLSH or ssdeep fuzzy hashes)
Level 6 : Apiscout and master-level malware analyst techniques
Malware tends to bypass all of the above in different manners. Some malware can even lie to or bypass all of the above, simultaneously. You definitely want to scale your IoCs when working against that threat space. However, you’ll also want to take into account factors that computers cannot scale —- the human element, surprise, and indications.
Perhaps you mean, how long should you monitor IoCs on the network? Or do you mean in sweeps across a fleet?
If you are looking for a way to manage IoCs on the network, check out the Bro Intelligence Framework. For fleet management of IoCs there are a few tools, such as Viper to database and view classic IoCs, YaraGuardian for organizing and searching Yara rules, Timesketch to play with the data, as well as ways of gathering artifacts and mining/monitoring log data.
There are many ways to approach artifact and log collection, in addition to monitoring, analysis, and synthesis. I like how these professionals outline 3 approaches —- https://posts.specterops.io/thoughts-on-host-based-detection-techniques-21d9c97082ce —- especially through their toolsets such as Automated Containment and Enrichment (ACE Server), Hunting ELK (HELK), and UpRoot. You’ll see the techniques from these toolsets in commercial platforms, such as Infocyte, Splunk Enterprise Security, and Carbon Black Cb Response, respectively. If you really want to scale fleet sweeps of IoCs, then the ACE Server, InfoCyte, and maybe even the PowerForensics or PowerShell Kansa tools are my first-round suggestions.