Intelligence
What is Indicator?
An observable such as a hash, domain or address that points to a specific intrusion. The most perishable thing in any report.
An indicator is an observable such as a hash, domain, IP address or URL that points to specific malicious activity. In common use it is the same idea as an IOC.
Indicators are the most perishable part of any threat report. They are useful for looking back through logs and for short-term blocking, but they should always be shared with their context: what the indicator was used for, when it was seen and how confident the source is.