A model of the system of ranking indicators of compromise for active counteraction to directed attacks is proposed, which allows pre-detecting threats and planning measures to eliminate them before their manifestation. Also an important aspect is the development of tools and methods for assessing sources of information on the level of trust to collect the necessary data in the investigation of incidents. Based on the proposed models, an information system for ranking indicators of compromise has been developed, which allows minimizing the possibility of violating confidentiality, integrity and availability of information, as well as compromising data in the system