[SANS ISC] Do you collect “Observables” or “IOCs”?

I published the following diary on isc.sans.edu: “Do you collect “Observables” or “IOCs”?“: Indicators of Compromise, or IOCs, are key elements in blue team activities. IOCs are mainly small pieces of technical information that have been collected during investigations, threat hunting activities or malware analysis. About the last example, the malware analyst’s goal

The post [SANS ISC] Do you collect “Observables” or “IOCs”? appeared first on /dev/random.

iocs isc sans sans internet storm center sans isc security threat hunting