IOC Analysis
Analyst15 min
Route: `/incident-response` — Title: **INCIDENT RESPONSE**
Respond faster. Paste logs, extract IOCs automatically, enrich indicators, and hunt them across your infrastructure — without switching tools.
What it's for
Extract and analyze indicators of compromise (IOCs) from text, files, or session history.
Steps
- Go to INCIDENT RESPONSE.
- Text Input tab.
- Paste data in the area (placeholder: `Paste your log data, security alerts, or any text containing IOCs here...`).
- (Optional) Load Example to test.
- Click Extract IOCs or Analyze IOCs (shows Analyzing...).
- Review cards: `Total IOCs`, `Threat Level`, `IOC Breakdown`.
- Select IOCs and click Query Selected in Logs.
- Security Logs drawer opens with results.
Expected result
- IOCs extracted and classified by type.
- Direct log query access from selected IOCs.
Tips
- Tabs: Text Input, File Upload, History (`Session History`, `Click to load`).
- IOC types: `IPv4`, `Domain`, `Email`, `URL`, `MD5`, `SHA256`.
- From Logs (Analytics mode): Back to Analytics button goes to `/logs`.