domains / families / security / analyzing-indicators-of-compromise

analyzing-indicators-of-compromise

separate

'Analyzes indicators of compromise (IOCs) including IP addresses, domains,

When to use

• A phishing email or alert generates IOCs (URLs, IP addresses, file hashes) requiring rapid triage
• Automated feeds deliver bulk IOCs that need confidence scoring before ingestion into blocking controls
• An incident investigation requires contextual enrichment of observed network artifacts

When not to use

• high-stakes blocking decisions in isolation

Skill page

Source