WFilter: Created page with "{{DISPLAYTITLE:Indicators of Compromise}} == Indicators of Compromise == IOCs(Indicators of Compromise) can detect clients may have been infiltrated by a cyber threat. This m..."

2023-10-17T06:55:22Z

Created page with "{{DISPLAYTITLE:Indicators of Compromise}} == Indicators of Compromise == IOCs(Indicators of Compromise) can detect clients may have been infiltrated by a cyber threat. This m..."

New page

{{DISPLAYTITLE:Indicators of Compromise}}
== Indicators of Compromise ==

IOCs(Indicators of Compromise) can detect clients may have been infiltrated by a cyber threat. This module is built on the Snort project.

== Settings ==

* IOCs Settings: setup the policy when a compromised client is detected.
** Record only, only record the attacks events.
** Record and block ip, record the attack events and block the source ip for a period.
* Add Alert Event: whether to add attacks events to the "Event" module.
* IP Whitelist: whitelisted traffic won't be checked. Syntax: 192.168.1.20，192.168.1.20/24.

[[File:icos_settings.png|900px]]

== Detection History ==

Query history records of detected malware events, including ip addresses, ports, type and messages.

[[File:icos_query.png|900px]]

[[Category:Security]]

IOCs - Revision history

WFilter: Created page with "{{DISPLAYTITLE:Indicators of Compromise}} == Indicators of Compromise == IOCs(Indicators of Compromise) can detect clients may have been infiltrated by a cyber threat. This m..."