⌕ Поиск по атласу

IETF · RFC · RFC9424

RFC9424 · Indicators of Compromise (IoCs) and Their Role in Attack Defence

Indicators of Compromise (IoCs) and Their Role in Attack Defence

Cyber defenders frequently rely on Indicators of Compromise (IoCs) to identify, trace, and block malicious activity in networks or on endpoints. This document reviews the fundamentals, opportunities, operational limitations, and recommendations for IoC use. It highlights the need for IoCs to be detectable in implementations of Internet protocols, tools, and technologies -- both for the IoCs' initial discovery and their use in detection -- and provides a foundation for approaches to operational challenges in network security.

Официальная английская аннотация

Cyber defenders frequently rely on Indicators of Compromise (IoCs) to identify, trace, and block malicious activity in networks or on endpoints. This document reviews the fundamentals, opportunities, operational limitations, and recommendations for IoC use. It highlights the need for IoCs to be detectable in implementations of Internet protocols, tools, and technologies -- both for the IoCs' initial discovery and their use in detection -- and provides a foundation for approaches to operational challenges in network security.

Связи документа

Официальный источник · 2023-08-01

Полные импортированные сведения карточки
{
  "id": "RFC9424",
  "number": 9424,
  "title_en": "Indicators of Compromise (IoCs) and Their Role in Attack Defence",
  "title_ru": "",
  "summary_ru": "",
  "purpose_ru": "",
  "use_ru": "",
  "full_translation_path": "",
  "full_translation_checked_at": "",
  "full_translation_source_sha256": "",
  "architect_note_ru": "",
  "topics_ru": [],
  "translation_state": "not_prepared",
  "verification_level": "not_prepared",
  "verification_level_ru": "Русская выжимка не подготовлена",
  "verification_note_ru": "",
  "abstract_en": "Cyber defenders frequently rely on Indicators of Compromise (IoCs) to identify, trace, and block malicious activity in networks or on endpoints. This document reviews the fundamentals, opportunities, operational limitations, and recommendations for IoC use. It highlights the need for IoCs to be detectable in implementations of Internet protocols, tools, and technologies -- both for the IoCs' initial discovery and their use in detection -- and provides a foundation for approaches to operational challenges in network security.",
  "authors": [
    "K. Paine",
    "O. Whitehouse",
    "J. Sellwood",
    "A. Shaw"
  ],
  "organizations": [],
  "publication_date": "2023-08-01",
  "current_status": "INFORMATIONAL",
  "current_status_ru": "Информационный",
  "publication_status": "INFORMATIONAL",
  "publication_status_ru": "Информационный",
  "lifecycle": "informational",
  "lifecycle_ru": "Справочный",
  "stream": "IETF",
  "stream_ru": "IETF",
  "area": "ops",
  "area_ru": "Эксплуатация и управление",
  "working_group": "opsec",
  "source_draft": "draft-ietf-opsec-indicators-of-compromise-04",
  "page_count": 24,
  "doi": "10.17487/RFC9424",
  "keywords": [
    "IOC",
    "Attack Defence"
  ],
  "formats": [
    "HTML",
    "TXT",
    "PDF",
    "XML"
  ],
  "relations": {
    "obsoletes": [],
    "obsoleted_by": [],
    "updates": [],
    "updated_by": [],
    "is_also": [],
    "see_also": []
  },
  "links": {
    "info": "https://www.rfc-editor.org/info/rfc9424/",
    "html": "https://www.rfc-editor.org/rfc/rfc9424.html",
    "txt": "https://www.rfc-editor.org/rfc/rfc9424.txt",
    "datatracker": "https://datatracker.ietf.org/doc/rfc9424/"
  }
}