New Indicator of Compromise hunting tool added to Searchlight Investigate

Indicators of Compromise (IoCs) are threat indicators related to a previous system breach. Security teams use this data to preemptively block compromise paths, prevent attacks, and detect red flags before attackers gain footholds on your network. With this addition to Searchlight Investigate, CTI and investigation teams can search from isolated indicators to broader threat actor and ransomware group profiles, making it easy to evaluate potential risks during investigations.

Risk-scoring IoCs in Searchlight Investigate

To ensure your analysts are working with actionable, high-fidelity data rather than noise, every indicator is continuously validated against a database of +40 GB of known-good infrastructure data. 

Each IoC also has its own detailed profile with a dynamic 0–100 threat score that intelligently decays over time, ensuring that inactive infrastructure naturally falls out of your actionable range. This saves your team time when prioritizing risks to your organization, with access to pre-vetted, scored, and enriched intelligence that cuts down manual research time and ensures analysts focus on active, relevant threats.

New Observation tab: How to search for IoCs

Users can navigate to the Threat Intelligence Hub > Observations to access the new IoC data, collated from C2 tracking, honeypots, and technology alliances. You can then search by IP address, URL, domain, or hash to investigate the validity of potential threats.

After clicking on a result, you are taken to the IoC profile, which includes a live risk score, a data panel showing when this was first seen and where, and links to relevant threat reports and insights. 

Use cases

Investigation teams can use the new IoC hunting capabilities to spot-check threats and:

• Connect isolated indicators to broader threat actor and ransomware group profiles
• Check suspicious IPs or domains during security reviews against a trusted and continuously maintained database