---
title: "Get an indicator of compromise"
method: GET
path: "/api/v2/security/siem/ioc-explorer/indicator"
tags: ["Security Monitoring"]
---

# Get an indicator of compromise

`GET /api/v2/security/siem/ioc-explorer/indicator`

Get detailed information about a specific indicator of compromise (IoC).

## Query parameters

- `indicator` string, required
- `ocsf` boolean
- `include_triage_history` boolean
- `triage_history_limit` integer
- `triage_history_offset` integer

## Response `200`

OK

- GetIoCIndicatorResponse — Response for the get indicator of compromise endpoint.
  - `data` GetIoCIndicatorResponseData — IoC indicator response data object.
    - `attributes` GetIoCIndicatorResponseAttributes — Attributes of the get indicator response.
      - `data` IoCIndicatorDetailed — An indicator of compromise with extended context from your environment.
        - `additional_data` object — Additional domain-specific context from threat intelligence sources.
        - `as_cidr_block` string — Autonomous system CIDR block.
        - `as_geo` IoCGeoLocation — Geographic location information for an IP indicator.
          - `city` string — City name.
          - `country_code` string — ISO country code.
          - `country_name` string — Full country name.
        - `as_number` string — Autonomous system number.
        - `as_organization` string — Autonomous system organization name.
        - `as_type` string — Autonomous system type.
        - `benign_sources` IoCSource[], nullable — Threat intelligence sources that flagged this indicator as benign.
          - `name` string — Name of the threat intelligence source.
        - `categories` string[] — Threat categories associated with the indicator.
        - `critical_assets` string[] — Critical assets associated with this indicator.
        - `first_seen` string, date-time — Timestamp when the indicator was first seen.
        - `hosts` string[] — Hosts associated with this indicator.
        - `id` string — Unique identifier for the indicator.
        - `indicator` string — The indicator value (for example, an IP address or domain).
        - `indicator_type` string — Type of indicator (for example, IP address or domain).
        - `last_seen` string, date-time — Timestamp when the indicator was last seen.
        - `log_matches` integer — Number of logs that matched this indicator.
        - `log_sources` string[] — Log sources where this indicator was observed.
        - `m_as_type` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT' — Effect of a scoring factor on the indicator's threat score.
        - `m_persistence` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT' — Effect of a scoring factor on the indicator's threat score.
        - `m_signal` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT' — Effect of a scoring factor on the indicator's threat score.
        - `m_sources` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT' — Effect of a scoring factor on the indicator's threat score.
        - `malicious_sources` IoCSource[], nullable — Threat intelligence sources that flagged this indicator as malicious.
          - `name` string — Name of the threat intelligence source.
        - `max_trust_score` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT' — Effect of a scoring factor on the indicator's threat score.
        - `score` number, double — Threat score for the indicator (0-100).
        - `services` string[] — Services where this indicator was observed.
        - `signal_matches` integer — Number of security signals that matched this indicator.
        - `signal_severity` IoCSignalSeverityCount[] — Breakdown of security signals by severity.
          - `count` integer — Number of signals at this severity level.
          - `severity` string — Severity level (for example, critical, high, medium, low, info).
        - `signal_tier` integer — Signal tier level.
        - `suspicious_sources` IoCSource[], nullable — Threat intelligence sources that flagged this indicator as suspicious.
          - `name` string — Name of the threat intelligence source.
        - `tags` string[] — Tags associated with the indicator.
        - `triage_history` IoCTriageEvent[] — Full triage history timeline. Returned only when `include_triage_history` is true.
          - `triage_state` 'not_reviewed' | 'reviewed' — Current triage state of the indicator.
          - `triaged_at` string, date-time — Timestamp when this triage action occurred.
          - `triaged_by` string — UUID of the user who performed this triage action.
        - `triage_state` 'not_reviewed' | 'reviewed' — Current triage state of the indicator.
        - `triaged_at` string, date-time — Timestamp when the indicator was last triaged.
        - `triaged_by` string — UUID of the user who last triaged the indicator.
        - `users` object — Users associated with this indicator, grouped by category.
    - `id` string — Unique identifier for the response.
    - `type` string — Response type identifier.

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `404` — Not Found
- `429` — Too many requests

---

[API](https://skmtc.dev/datadog/apis/api-v2.md) · [All operations](https://skmtc.dev/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)