IOC Statistics

The Indicators of Compromise (IOC) Statistics dashboard gives a high-level view of potentially malicious activities in your network based on matching data from your threat intelligence providers.

Threat intelligence data is available to the dashboard from the Context Collectors service which includes the following built-in threat intelligence collectors:

Exabeam Threat Intelligence Domains – Collects data about known malicious domains.
Exabeam Threat Intelligence IPs – Collects data about known malicious IP addresses.

For information about these context collectors, see Built-In Threat Intelligence Context Collectors.

Time Range Filter

The Event : Approx Log Time filter sets the time range for the event data. The default setting is in the last 7 days. You can update this filter with a wide range of customizable settings.

To update the time range filter, click the arrow () on the right, under the Edit button, to expand the filters panel. In the Event : Approx Log Time filter, select an operator from the first drop down menu and then enter or select values in the subsequent fields, depending on the operator you selected. To save your filter changes, click Apply on the right side of the filter panel. The updated filter is applied to the visualization.

IOC Summary

IOC Matches | IOC Types

The bar graphs in this section represent the total number of IOC matches and types.

IOC Types Over Time

This heat map displays the number of occurrences of the different IOC types over the selected time range. Darker shading indicates a greater count. To view the underlying events of a value, click the square, and then click Show Results in Search.

IOC Trend Analysis

IOC Trend

This area chart represents the occurrences of different anomaly types over the selected time range. Move your pointer over a graph area to highlight it and display the represented count values. To view the underlying events of a value, click the data point, and then click Show Results in Search.

IOC Statistics – Domains & IP Addresses

IOC Domains | IOC Source IPs | IOC Destination IPs

The bar graphs in this section represent the total number of IOC domains, source IPs, and destination IPs.

Top 5 IOC Destination IPs

To view the IP count values represented by the bars, move your pointer over them. To view the underlying events of a value, click the bar, and then click Show Results in Search.

Top 5 IOC Domains

To view the domain count values represented by the bars, move your pointer over them. To view the underlying events of a value, click the bar, and then click Show Results in Search.

Top 5 IOC Source IPs