---
title: "List indicators of compromise"
method: GET
path: "/api/v2/security/siem/ioc-explorer"
tags: ["Security Monitoring"]
---

# List indicators of compromise

`GET /api/v2/security/siem/ioc-explorer`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security/siem/ioc-explorer`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_signals_read`

Get a list of indicators of compromise (IoCs) matching the specified filters.

## Query parameters

- `limit` integer
- `offset` integer
- `query` string
- `sort[column]` string
- `sort[order]` string
- `ocsf` boolean
- `worked_by` string
- `triage_state` 'not_reviewed' | 'reviewed': Current triage state of the indicator.

## Response `200`

OK

- IoCExplorerListResponse: Response for the list indicators of compromise endpoint.
  - `data` IoCExplorerListResponseData: IoC Explorer list response data object.
    - `attributes` IoCExplorerListResponseAttributes: Attributes of the IoC Explorer list response.
      - `data` IoCIndicator[]: List of indicators of compromise.
        - `as_geo` IoCGeoLocation: Geographic location information for an IP indicator.
          - `city` string: City name.
          - `country_code` string: ISO country code.
          - `country_name` string: Full country name.
        - `as_type` string: Autonomous system type.
        - `benign_sources` IoCSource[], nullable: Threat intelligence sources that flagged this indicator as benign.
          - `name` string: Name of the threat intelligence source.
        - `categories` string[]: Threat categories associated with the indicator.
        - `first_seen` string, date-time: Timestamp when the indicator was first seen.
        - `id` string: Unique identifier for the indicator.
        - `indicator` string: The indicator value (for example, an IP address or domain).
        - `indicator_type` string: Type of indicator (for example, IP address or domain).
        - `last_seen` string, date-time: Timestamp when the indicator was last seen.
        - `log_matches` integer: Number of logs that matched this indicator.
        - `m_as_type` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT': Effect of a scoring factor on the indicator's threat score.
        - `m_persistence` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT': Effect of a scoring factor on the indicator's threat score.
        - `m_signal` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT': Effect of a scoring factor on the indicator's threat score.
        - `m_sources` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT': Effect of a scoring factor on the indicator's threat score.
        - `malicious_sources` IoCSource[], nullable: Threat intelligence sources that flagged this indicator as malicious.
          - `name` string: Name of the threat intelligence source.
        - `max_trust_score` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT': Effect of a scoring factor on the indicator's threat score.
        - `score` number, double: Threat score for the indicator (0-100).
        - `signal_matches` integer: Number of security signals that matched this indicator.
        - `signal_tier` integer: Signal tier level.
        - `suspicious_sources` IoCSource[], nullable: Threat intelligence sources that flagged this indicator as suspicious.
          - `name` string: Name of the threat intelligence source.
        - `tags` string[]: Tags associated with the indicator.
        - `triage_state` 'not_reviewed' | 'reviewed': Current triage state of the indicator.
        - `triaged_at` string, date-time: Timestamp when the indicator was last triaged.
        - `triaged_by` string: UUID of the user who last triaged the indicator.
      - `metadata` IoCExplorerListResponseMetadata: Response metadata.
        - `count` integer: Total number of indicators matching the query.
      - `paging` IoCExplorerListResponsePaging: Pagination information.
        - `offset` integer: Current pagination offset.
    - `id` string: Unique identifier for the response.
    - `type` string: Response type identifier.

## Other responses

- `400`: Bad Request
- `403`: Not Authorized
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)