Question

Does your organization use Indicators of Compromise (IOC) during the incident response process? If so, how are they used and by whom?

Answer 1

Indicators of Compromise(IOCs) are key data points used during in incident response process. Your organizations response handler will use these indicators in different phase of incident response from the detection through containment and mitigation actions.

Indicators can be received from a third party, such as sharing through a threat intelligence platform, or as the result of an internal incident investigation. Regardless the source,once these indicators have been vetted and proven reliable, they can be used as the lead for identifying further leads.

This is exactly what pivoting is: You start with a reliable data point to guide you through the next steps in your incident response process.

IOCs: Verified or Bust
All indicators-whatever the source-should go through a verification process,ensuring that the quality of the indicators remains high. good indicators allow ypu to pivot to other good indicator,where as poor indicators will only lead to more of the same.
This verification process will vary between organizations and, in some cases, can contradict organizational requests for automatic processing of indicators, Howewver,it is a necessary step to avoid going off track when responding to a real threat.