Indicators of compromiseedit

The Indicators page (Intelligence → Indicators) collects data from enabled threat intelligence feeds and provides a centralized view of indicators, also known as indicators of compromise (IoCs). This topic helps you set up the Indicators page and explains how to work with IoCs.

Shows the Indicators page

Threat intelligence and indicatorsedit

Threat intelligence is a research function that analyzes current and emerging threats and recommends appropriate actions to strengthen a company’s security posture. Threat intelligence requires proactivity to be useful, such as gathering, analyzing, and investigating various threat and vulnerability data sources.

An indicator, also referred to as an IoC, is a piece of information associated with a known threat or reported vulnerability. There are many types of indicators, including URLs, files, domains, email addresses, and more. Within SOC teams, threat intelligence analysts use indicators to detect, assess, and respond to threats.

Set up the Indicators pageedit

Install a threat intelligence integration to add indicators to the Indicators page.

  1. Choose one of the following:

    • From the Elastic Security app main menu, go to IntelligenceIndicatorsAdd Integrations.
    • From the Kibana main menu, click Add integrations. Scroll down the list of integration categories and select Threat Intelligence to filter by threat intelligence integrations.
  2. Select a threat intelligence integration, then complete the integration’s guided installation.

    For more information about available fields, go to the Elastic integration documentation and search for a specific threat intelligence integration.

  3. Return to the Indicators page in Elastic Security. Refresh the page if indicator data isn’t displaying.


If indicator data is not appearing in the Indicators table after you installed a threat intelligence integration:

  • Verify that the index storing indicator documents is included in the default Elastic Security indices (securitySolution:defaultIndex). The index storing indicator documents will differ based on the way you’re collecting indicator data:

    • Elastic Agent integrations - logs_ti*
    • Filebeat integrations - filebeat-*
  • Ensure the indicator data you’re ingesting is mapped to Elastic Common Schema (ECS).

Indicators page UIedit

After you add indicators to the Indicators page, you can examine, search, filter, and take action on indicator data. Indicators also appear in the Trend view, which shows the occurrence of indicators over time.

interact with indicators table

Examine indicator detailsedit

Learn more about an indicator by clicking View details, then opening the Indicator details flyout. The flyout contains these informational tabs:

  • Overview: A summary of the indicator, including the indicator’s name, the threat intelligence feed it came from, the indicator type, and additional relevant data.

    Some threat intelligence feeds provide Traffic Light Protocol (TLP) markings. The TLP Marking and Confidence fields will be empty if the feed doesn’t provide that data.

  • Table: The indicator data in table format.
  • JSON: The indicator data in JSON format.

    Shows the Indicator details flyout

Find related security eventsedit

Investigating an indicator in Timeline helps you find related security events in your environment. You can add an indicator to Timeline from the Indicators table or the Indicator details flyout.

Shows the results of an indicator being investigated in Timeline

When you add an indicator to Timeline, a new Timeline opens with a pre-populated KQL query. The query contains the indicator field-value pair that you selected plus the field-value pair of the mapped source event.

For example, imagine you’ve added this file hash indicator to Timeline:

threat.indicator.file.hash.sha256 : c207213257a63589b1e1bd2f459b47becd000c1af8ea7983dd9541aff145c3ba

A new Timeline opens with an automatically populated KQL query. The query contains the indicator field-value pair (mentioned previously) and the mapped source event field-value pair, which is:

file.hash.sha256 : c207213257a63589b1e1bd2f459b47becd000c1af8ea7983dd9541aff145c3ba.

Using a KQL query that includes both the indicator and source event allows Timeline to find all events and alerts that have matching field-value pairs.