Okuzeka
Cybersecurity vocabulary · Incident Response

Indicator of compromise

Meaning in cybersecurity, with examples

nounCommon term

In cybersecurity, indicator of compromise means: A piece of technical evidence that suggests a system may have been attacked, such as a malicious IP address, file hash or domain name.

In Turkish: ihlal göstergesi, tehlike göstergesi, IOC

How it is used

Almost always called an IOC or IoC, said letter by letter. Analysts collect, share and search for IOCs in logs and EDR data. Because attackers can change them easily, IOCs are usually combined with detections based on behaviour.

Example sentences

  1. We searched all mailboxes for the indicators of compromise listed in the advisory.

  2. No indicator of compromise was found on the remaining servers.

Common collocations

  • IOC list
  • share IOCs
  • search for IOCs
  • indicators of attack
  • threat intelligenceCollected and analysed information about attackers, their methods and their tools that helps an organisation prepare for and detect attacks.
  • hashA fixed-length value calculated from data by a one-way function. The same input always gives the same hash, but the original data cannot be rebuilt from it.
  • digital forensicsThe collection and analysis of digital evidence, such as disk images, memory and logs, to find out what happened during an incident in a way that can stand up in court.
  • compromiseTo get unauthorised access to or control of a system, account or network, so that it can no longer be trusted.

This word in other fields

The same English word can have a different meaning in another field:

More terms: Incident Response

Practise with graded reading

Reading at the right level is the fastest way to make new words stick. Pick free English books by level: