Glossary
IOC (indicator of compromise)
An IOC is an observable artifact, such as an IP address, domain, URL or file hash, associated with malicious activity and used to search for it elsewhere.
An indicator of compromise (IOC) is an observable value associated with malicious or suspicious activity that can be searched for in other data: an IP address, a domain name, a URL, a file hash, and sometimes a TLS fingerprint such as JA4. IOCs are shared in threat-intelligence reports and platforms, and matched against logs, captures and endpoints.
In a capture, candidate IOCs come from conversations, DNS answers, HTTP requests, TLS server names and extracted files. They are only as good as their context: shared hosting, CDNs and cloud addresses make IP indicators short-lived. PCAP Parser builds a de-duplicated IOC list with counts, first and last seen and address scope; see how to use PCAP Parser.