Definition
An Indicator of Attack (IOA) is an observable behavioural sign indicating that an attack is underway or may be about to begin.
Human Explanation
IOAs focus on how an attacker behaves rather than on traces left after an attack has finished.
Why it Matters
They support earlier Threat detection and response before a system is fully compromised.
Conceptual Boundary
IOAs do not describe specific files or IP addresses. They concern behaviours and sequences of activity characteristic of an attack.
Practical Perspective
Behavioural analysis may reveal new Threats before known IOCs become available.