Viewing the table of IOC files

If you are using the distributed solution and multitenancy mode, use the web interface of the PCN or SCN server for which you want to configure parameters.

The table of IOC files contains information about IOC files used for scanning on computers with the Endpoint Agent component installed; you can find the table in the Custom rules section, IOC subsection of the application web interface window.

The table of IOC files contains the following information:

—Importance level that will be assigned to an alert generated using this IOC file.
The importance level can have one of the following values:
- – Low importance.
- – Medium importance.
- – High importance.
Type—Type of IOC file depending on the application operating mode and the server to which the IOC file was uploaded:
- Local—IOC files uploaded to an SCN server. These IOC files are used to search for indicators of compromise on hosts with the Endpoint Agent component connected to the SCN server.
- Global—IOC files uploaded to the PCN server. These IOC files are used to search for indicators of compromise on hosts with the Endpoint Agent component connected to the PCN server and all SCN servers connected to the PCN server.
Name—Name of the IOC file.
Servers are names of servers with the PCN or SCN role to which the rule applies.
This column is displayed if you are using the distributed solution and multitenancy mode.
Autoscan—The IOC file is used when automatically scanning hosts with the Endpoint Agent component.
Host scanning using this IOC file can have one of the following statuses:
- Enabled
- Disabled