Indicators of Compromise (IOCs) are commonly derived from which sources?

• A. Internal reports
• B. Threat intel feeds
• C. Malware analysis sandboxes
• D. ISACs

Answer: (B)

Indicators of Compromise are data points that help you recognize malicious activity, such as known bad IPs, domains, file hashes, and URLs. The most common way to obtain them is threat intelligence feeds, which collect and curate indicators from multiple sources—research communities, security vendors, and information sharing with other organizations—and deliver them in a format your security tools can consume. This makes it easier to detect and automatically block threats across your environment.

Internal reports can spark IOCs when you investigate incidents, but they’re typically limited to your own environment and not as scalable. Malware analysis sandboxes generate artifacts during dynamic analysis, which can become IOCs, but they’re more about producing specific findings than supplying a broad, ongoing feed. ISACs provide sector-wide information sharing and context, which is valuable, but threat intelligence feeds are the primary, widely used source for IOCs in routine security operations.