Intelligence
What is IOC?
Indicator of Compromise: an observable such as a hash, domain or IP that suggests a specific intrusion.
An indicator of compromise is an observable piece of evidence that suggests a system or network has been breached: a file hash, an IP address, a domain, a URL, a registry key, an email sender or a mutex name.
IOCs are easy to share and quick to search for, so they are the most common content of threat feeds. They also expire quickly, because attackers rotate infrastructure and rebuild files. An IOC is most useful in the days after it is published and when paired with the behaviour it came from.