IOC
A technical artifact used in cybersecurity analysis to identify evidence of system or network intrusion. Common forms include malicious IP addresses, domain names, file hashes, and anomalous registry keys. IOCs are machine-readable and can be shared across organizations and platforms.
Timeline (last 90 days)
Indicators of Compromise (IOCs) refer to technical artifacts found in a system or network that can be used to determine whether an intrusion has occurred, with common forms including malicious IP addresses, domain names, file hashes, and abnormal registry key values
A single security incident often involves dozens to hundreds of IOCs, and traditional analysis requires analysts to cross-validate and correlate context one by one, which is extremely time-consuming
The planning model dynamically decides which tools to call and which intelligence sources to query next based on current IOCs and context, rather than executing fixed rule scripts
All Facts (3)
Indicators of Compromise (IOCs) refer to technical artifacts found in a system or network that can be used to determine whether an intrusion has occurred, with common forms including malicious IP addresses, domain names, file hashes, and abnormal registry key values
50%UnverifiedA single security incident often involves dozens to hundreds of IOCs, and traditional analysis requires analysts to cross-validate and correlate context one by one, which is extremely time-consuming
50%UnverifiedThe planning model dynamically decides which tools to call and which intelligence sources to query next based on current IOCs and context, rather than executing fixed rule scripts
50%