Definition
An Indicator of Compromise (IOC) is an observable trace indicating that a security breach may have occurred or that a Threat may be present in a system.
Human Explanation
IOCs are evidence left after an attack, such as suspicious IP addresses, filenames, cryptographic hashes or domains.
Why it Matters
IOCs help detect Incidents and identify systems that may have been compromised.
Conceptual Boundary
IOCs describe traces left by Threat activity, not the way the attack itself was performed.
Practical Perspective
IOCs enable rapid searching across an environment for similar signs of compromise.