Revisiting the Indicator: Towards a Threat Intelligence Ontology

"Indicators" or "Indicators of Compromise" (IOCs) form the common currency of threat intelligence communication and, at times, application. Yet further examination of the concept of "the indicator" reveals significant fuzziness around what the term actually means in definition or subsequent use. Some might feel this is mere nit-picking, but confusion and conflation surrounding the use of the word "indicator" has effectively set back the threat intelligence discipline and led to suboptimal outcomes in using intelligence concepts.

In this session, we …

application communication compromise concept currency definition indicators indicators of compromise intelligence iocs ontology picking threat threat intelligence