Skip to main content

Check One IOC

These retained guides document AdversaryGraph v7.0.0. Latest published stable release: v8.1.2. Current development: 8.1.2, verified 2026-10-20 at source commit 789d874. Historical screenshots and instructions are not evidence of current-release behavior.

Check One IOC workflow

Level: Simple

Goal: Check whether one IP, domain, URL, or hash has useful enrichment context.

Real-Life Scenario​

A SOC analyst receives a suspicious domain from an EDR alert during morning triage and needs to know in under two minutes whether it is known malicious, related to malware, or only a weak signal.

When To Use This​

Use this workflow when you need a fast, low-friction action and want the output to remain traceable to evidence.

Steps​

  1. Open VirusTotal Lookup or IOC Library Enrichment.
  2. Submit the indicator and review reputation, tags, relationships, and possible actor/TTP links.

Expected Result​

Quick IOC context for triage or hunting seed.

Review Notes​

  • Keep source labels and evidence attached to every accepted result.
  • Treat actor matches, enrichment hits, and matrix overlap as analytical signals until corroborated.
  • Export only reviewed findings for customer, SOC, detection engineering, or executive use.