New taxonomy to describe current state of takedown / cleanup / other actions on indicator

[iglocska]

Let whoever is "accused" of having compromised infrastructure to respond / mark data as cleaned up / resolved / being worked on, etc.

[cert-orangecyberdefense]

Hi, we kind of use:

-contact failed (wrong number, out of office hours, etc.) -no reponse yet (i.e. waiting for a response) -demand acknowledged -action refused -action confirmed

HTH