An indicator of compromise (IoC) is evidence that may point to a security breach. It is a reason to investigate, not proof that a breach occurred. Analysts examine suspicious activity to distinguish benign anomalies from genuine threats and assess the risk to the organization. section 8.6
During incident triage, look for patterns across:
- Unusual network traffic, unauthorized access attempts, or unexpected changes to system files. section 9.5
- System logs, network traffic, and security alerts that help establish what happened and which systems or data may be affected. section 9.5
A login spike needs investigation
A SIEM detects 5,000 failed attempts against a database administrator account in five minutes. The spike is recorded as an IoC; the source IP is also flagged by threat intelligence. Investigators block the IP, review access logs, and check whether any attempt succeeded. The risk is potential unauthorized access to sensitive data, even though the subsequent review confirms none occurred. section 9.4.4
Correlate IoCs with other evidence, reconstruct the incident timeline, and assess business and operational effects before prioritizing a response. Put threat intelligence and IoCs on an analyst dashboard for investigation; give leadership the resulting risk and incident trends rather than an unexplained count of indicators. Automated correlation can surface subtle signals, but a flagged pattern still needs analysis. section 9.5 section 2.2.1 section 10.0
