IOC

An IOC is a piece of forensic evidence, like a file hash, IP address, or domain name, that suggests a system has been breached. SOC teams search their logs and endpoints for known IOCs to find infections and scope incidents. They matter because sharing IOCs lets defenders quickly check whether an attack seen elsewhere has hit them too.