Viewing information about an IOC file

To view information about an IOC file:

1. In the program web interface window, select the IOC/IOA Analysis section, IOC Scanner subsection.

   The table of IOC files opens.

2. Select the IOC file for which you want to view information.

This opens a window containing information about the IOC file.

The window contains the following information:

• Find alerts. Clicking the link opens the Alerts section with the filter condition containing your selected IOC file.
• Find events. Clicking the link opens the Threat Hunting section with the search condition containing your selected IOC file.
• Download file. Clicking the link opens the IOC file download window.
• Autoscan—Use of an IOC file during an automatic scan of events.

  Event scanning using this IOC file can have one of the following statuses:

  • Enabled
  • Disabled
• Name—Name of the IOC file.
• Importance—Importance level that will be assigned to an alert generated using this IOC file.

  The importance level can have one of the following values:

  • —Low importance.
  • —Medium importance.
  • —High importance.
• Apply to. Displays the name of the organization and the names of servers associated with events scanned based on this IOC file (in the distributed solution and multitenancy mode).
• XML. Displays the IOC file contents in XML format.

See also IOC scan of events Viewing the table of IOC files Uploading an IOC file Downloading an IOC file to a computer Enabling and disabling the automatic use of an IOC file when scanning events Deleting an IOC file Searching IOC scan results Filtering and searching IOC files Clearing an IOC file filter Configuring an IOC scan schedule Supported OpenIOC Indicators of Compromise

Page top