1. A computer-implemented method comprising: receiving, at a computing device, an evidence corresponding to a malicious activity, wherein the evidence is received from an external computing device and is stored in a file by the computing device; extracting, by the computing device with an extraction engine, one or more indicators from the evidence by analyzing the contents of the file in which the evidence was stored; creating, with the computing device, a sensor based rule from the one or more indicators; bidirectionally linking, by the computing device, the one or more indicators extracted from the evidence to the evidence from which the indicators were extracted, wherein the linking is to the evidence stored in the file by the computing device and establishes a bidirectional linkage between the one or more indicators and the evidence from which the indicators were extracted, wherein the bidirectional linkage between the one or more indicators and the evidence is used to determine that the one or more indicators were extracted from the evidence; bidirectionally linking the sensor based rule to the evidence it originated from, wherein the linking establishes a bidirectional linkage between the sensor based rule and the evidence wherein the bidirectional linkage between the sensor based rule and the evidence is used to determine that the sensor based rule originated from the evidence; bidirectionally linking the sensor based rule to the indicator it originated from, wherein the linking establishes a bidirectional linkage between the sensor based rule and the indicator wherein the bidirectional linkage between the sensor based rule and the indicator is used to determine that the sensor based rule originated from the indicator; and creating a sensor configuration for tasking the sensor based rule to a sensor of an intrusion prevention or intrusion detection system, wherein the sensor monitors one or more of the computer system and a network infrastructure to which the computer system is connected.