Get a demo
PartnersMSSPCompany
Threat Analysis

IOC Sweep

An IOC sweep checks whether known indicators from a threat report appear anywhere in your environment. It is usually the first search run after a new campaign is published.

Steps in a sweep

Indicators are cleaned of defanging (for example hxxp and [.]), grouped by type, and searched in each tool that records that type. Each tool reports matches, or no matches, over a stated time window.

Limits

Indicators change quickly and attackers reuse infrastructure rarely, so a clean sweep says little about behavior. Pair sweeps with behavior-based hunts.

FourCore HUNT runs hunts like this inside your SIEM and EDR/XDR. See how it works →

Related reading

Glossary

Indicator of Compromise (IOC)

An indicator of compromise is a forensic artifact or observable signal that suggests a system, account, or network may already have been compromised.

Glossary

Threat Intelligence

Threat intelligence is actionable, evidence-based knowledge about cybersecurity threats — including context, mechanisms, indicators, and implications — that helps organizations make informed security decisions.

Glossary

Hunt Hypothesis

A hunt hypothesis is a testable statement about attacker activity that may be present in an environment, used to decide what a threat hunt searches for.

Glossary

Indicator of Attack (IOA)

An indicator of attack is a behavioral signal that suggests an attack is underway, even if no confirmed compromise artifact has been observed yet.

← Back to Glossary