---
title: "Get an indicator of compromise"
method: GET
path: "/api/v2/security/siem/ioc-explorer/indicator"
tags: ["Security Monitoring"]
---

# Get an indicator of compromise

`GET /api/v2/security/siem/ioc-explorer/indicator`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security/siem/ioc-explorer/indicator`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_signals_read`

Get detailed information about a specific indicator of compromise (IoC).

## Query parameters

- `indicator` string, required
- `ocsf` boolean
- `include_triage_history` boolean
- `triage_history_limit` integer
- `triage_history_offset` integer

## Response `200`

OK

- GetIoCIndicatorResponse: Response for the get indicator of compromise endpoint.
  - `data` GetIoCIndicatorResponseData: IoC indicator response data object.
    - `attributes` GetIoCIndicatorResponseAttributes: Attributes of the get indicator response.
      - `data` IoCIndicatorDetailed: An indicator of compromise with extended context from your environment.
        - `additional_data` object: Additional domain-specific context from threat intelligence sources.
        - `as_cidr_block` string: Autonomous system CIDR block.
        - `as_geo` IoCGeoLocation: Geographic location information for an IP indicator.
          - `city` string: City name.
          - `country_code` string: ISO country code.
          - `country_name` string: Full country name.
        - `as_number` string: Autonomous system number.
        - `as_organization` string: Autonomous system organization name.
        - `as_type` string: Autonomous system type.
        - `benign_sources` IoCSource[], nullable: Threat intelligence sources that flagged this indicator as benign.
          - `name` string: Name of the threat intelligence source.
        - `categories` string[]: Threat categories associated with the indicator.
        - `critical_assets` string[]: Critical assets associated with this indicator.
        - `first_seen` string, date-time: Timestamp when the indicator was first seen.
        - `hosts` string[]: Hosts associated with this indicator.
        - `id` string: Unique identifier for the indicator.
        - `indicator` string: The indicator value (for example, an IP address or domain).
        - `indicator_type` string: Type of indicator (for example, IP address or domain).
        - `last_seen` string, date-time: Timestamp when the indicator was last seen.
        - `log_matches` integer: Number of logs that matched this indicator.
        - `log_sources` string[]: Log sources where this indicator was observed.
        - `m_as_type` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT': Effect of a scoring factor on the indicator's threat score.
        - `m_persistence` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT': Effect of a scoring factor on the indicator's threat score.
        - `m_signal` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT': Effect of a scoring factor on the indicator's threat score.
        - `m_sources` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT': Effect of a scoring factor on the indicator's threat score.
        - `malicious_sources` IoCSource[], nullable: Threat intelligence sources that flagged this indicator as malicious.
          - `name` string: Name of the threat intelligence source.
        - `max_trust_score` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT': Effect of a scoring factor on the indicator's threat score.
        - `score` number, double: Threat score for the indicator (0-100).
        - `services` string[]: Services where this indicator was observed.
        - `signal_matches` integer: Number of security signals that matched this indicator.
        - `signal_severity` IoCSignalSeverityCount[]: Breakdown of security signals by severity.
          - `count` integer: Number of signals at this severity level.
          - `severity` string: Severity level (for example, critical, high, medium, low, info).
        - `signal_tier` integer: Signal tier level.
        - `suspicious_sources` IoCSource[], nullable: Threat intelligence sources that flagged this indicator as suspicious.
          - `name` string: Name of the threat intelligence source.
        - `tags` string[]: Tags associated with the indicator.
        - `triage_history` IoCTriageEvent[]: Full triage history timeline. Returned only when `include_triage_history` is true.
          - `triage_state` 'not_reviewed' | 'reviewed': Current triage state of the indicator.
          - `triaged_at` string, date-time: Timestamp when this triage action occurred.
          - `triaged_by` string: UUID of the user who performed this triage action.
        - `triage_state` 'not_reviewed' | 'reviewed': Current triage state of the indicator.
        - `triaged_at` string, date-time: Timestamp when the indicator was last triaged.
        - `triaged_by` string: UUID of the user who last triaged the indicator.
        - `users` object: Users associated with this indicator, grouped by category.
    - `id` string: Unique identifier for the response.
    - `type` string: Response type identifier.

## Other responses

- `400`: Bad Request
- `403`: Not Authorized
- `404`: Not Found
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)