Definition
Indicators of compromise (IOCs) are pieces of forensic data, such as log entries or network traffic patterns, that signal a potential security breach or ongoing cyberattack. These artifacts provide evidence that a system or network has been compromised and can be used to detect and respond to threats. Understanding IOCs is crucial for security professionals to identify malicious activity, contain breaches, and prevent further damage. For instance, an unusual number of failed login attempts followed by a successful login from an unfamiliar IP address could be an IOC. While IOCs point to a past or present compromise, threat intelligence provides broader context about potential future threats. These concepts are frequently tested on certifications like CompTIA Security+ and CySA+.