domains / families / security / collecting-indicators-of-compromise

collecting-indicators-of-compromise

separate

'Systematically collects, categorizes, and distributes indicators of

When to use

• During active incident response to identify and block adversary infrastructure
• Post-incident to document all observed adversary artifacts for future detection
• When sharing threat intelligence with ISACs, sector partners, or law enforcement
• When building detection rules in SIEM, EDR, or network security tools
• When enriching IOCs with threat intelligence context for risk scoring

When not to use

• behavioral TTP analysis without accompanying technical indicators

Skill page

Source