CyberGuard dictionary / Threat Intelligence
Indicator of Compromise
Also known as IOC
An observable artifact that may indicate a system was compromised.
In simple terms
An IOC is a clue investigators can look for after suspicious activity.
Technical explanation
Indicators can include hashes, domains, addresses, or file paths, but a match needs context and may be short-lived or benign.
An indicator is a clue tied to observed activity, not a verdict by itself. Analysts consider source reliability, time window, prevalence, and corroborating behavior before escalating.
Examples in practice
A response team searches logs for a domain linked to a confirmed intrusion.
A domain appears in one workstation's DNS logs, but the user never connected to it. The analyst checks proxy, endpoint, and email records before deciding whether there was an infection.
Why it matters
Indicators aid investigation but do not independently prove malicious activity.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.