SonicOS 8 Rules and Policies for Policy Mode
Table of Contents
Indicator of Compromise
An Indicator of Compromise (IOC) is a sign of suspicious or abnormal activity within a network. IOCs serve as early warnings for potential threats and aid investigations, enabling organizations to respond swiftly and minimize damage.
This feature enables administrators to enforce a file containing malicious IP addresses. The firewall can be set to download this file automatically from an HTTPS or FTP server.
SonicOS adds these IP entries to the block list, blocks matching traffic, and logs the activity under Monitor > System Logs.
