QuestionQ74Verified/Rule ConfigurationCopy linkReport a problemAsk AstroTutorSave questionWhen creating new IOCs in IOC management, which of the following fields must be configured?AHash, Description, FilenameBHash, Action and Expiry DateCFilename, Severity and Expiry DateDHash, Platform and ActionShow AnswerAnswerExplanationA file IOC is defined by its hash and must include the action to take. The IOC configuration also includes an expiration date that determines how long the indicator remains in effect; filename, platform, and severity are not required core fields in this configuration.Learn moreCreate indicators for files — Microsoft Defender for EndpointShow comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion