Indicator of compromise
An indicator of compromise is an observable artifact, attribute, or behavior suggesting that a system or environment may have been compromised.
Data-Driven Cybersecurity
An indicator of compromise is an observable artifact or behavior suggesting that a system or environment has been compromised.
- How it is used
- Supports incident detection and triage by directing analysts toward suspicious evidence that needs risk assessment.
- How deep it goes
- Defines IoCs as potential-breach evidence and places them in a practical investigation workflow without detailing indicator formats.
- Examples
- Uses a failed-login spike against a database administrator account, a flagged IP address, and an incident report.
- What you can do after
- Apply it via Wazuh-supported incident analysis to correlate suspicious activity, assess affected systems, and prioritize response.
Read how Data-Driven Cybersecurity explains indicator of compromise →
Cyber Threat Hunting
An observable artifact or attribute associated with a system or activity that may indicate malicious compromise.
- How it is used
- Uses observable indicators to test threat hypotheses, uncover incidents, expand searches, and improve detection and intelligence content.
- How deep it goes
- Explains indicator selection through examples and hunt-play structure, but stops short of detailed indicator-analysis internals.
- Examples
- Uses encoded PowerShell, unsigned scripts, suspicious arguments, parent processes, techniques, procedures, and required data sources.
- What you can do after
- Diagnose/debug potential compromise by selecting indicators, searching available data, judging hypothesis results, and escalating confirmed findings.
Read how Cyber Threat Hunting explains indicator of compromise →
Related concepts
- threat-hunting playused by · A repeatable operational procedure for conducting a particular threat hunt and recording its investigative scope and logic.
- postincident analysisused by · Postincident analysis is a structured examination of an incident and its response to understand what occurred, identify causes, and determine improvements or corrective actions.
- information security continuous monitoringuses · Information security continuous monitoring is the ongoing collection and analysis of systems, networks, controls, and activity to maintain security awareness and identify relevant changes, threats, or incidents.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.