Indicator of compromise
An indicator of compromise is an observable artifact or pattern that suggests a possible, ongoing, or past attack and gives defenders something specific to investigate.
Treat a match as a lead
An indicator may be a domain, IP address, file fingerprint, or another observable linked to suspicious activity. To use it well, you need its source, relevant time period, and meaning. NIST’s definition includes signs of an imminent attack; an indicator match does not always mean a compromise has happened.
NIST’s information-sharing guidance notes that an isolated indicator can be ambiguous. Supporting activity helps establish what a match means in your environment.
A matching IP address needs investigation
A sign-in from an IP address in a threat report is worth checking. The match alone does not tell you who signed in or whether they accessed sensitive data.
Check the report date, sign-in time, account, and corresponding application activity. When sharing the finding, distinguish the confirmed address match from unanswered questions about who used it and what they did. Include the source, observation date, uncertainty, and any handling restrictions.