---
module: aria.ioc-management
title: IOC Management
tab: Testing
order: 35
audience: dev
---

Frontend test checklist for **IOC Management** in ARIA (`aria.bcos.dev`). Click through in the UI and mark each row Pass or Fail.

## Set up
Log in at **aria.bcos.dev** — test accounts (all password `Passw0rd-d3v!`):

| Login | Role | Sees |
|-------|------|------|
| `bcos_a@bcos.dev` | Admin | Full IOC Management — can add / edit / deactivate |
| `msp_a@msp1.bcos.dev` | MSP admin | **No access** — this screen is admin-only |
| `customer_a@customer1.bcos.dev` | Customer | **No access** — this screen is admin-only |

This is a **global watchlist** — it is not tied to a device or institution, so no simulator devices are needed. The list starts pre-seeded with FBI FLASH indicators (e.g. Ploutus jackpotting filenames).

## What to test

| # | Do this | ✅ Pass if |
|---|---------|-----------|
| 1 | As `bcos_a`, open **IOC Management** | Table loads with columns **Type · Value · Description · Source · Confidence · Added · Expires · Status** and some seeded rows |
| 2 | Expand the **Filters** sidebar (▶) and click a type pill (e.g. **Filename**) | Only that type shows, a filter chip appears up top, and the count updates. **Clear all** brings every row back |
| 3 | In Filters, tick **Show inactive** | Retired **Inactive** rows appear (dimmed) alongside the Active ones |
| 4 | Click **+ Add IOC**, leave Type/Value blank, click **Add IOC** | A validation warning shows and **nothing is added** — panel stays open |
| 5 | Fill Type **Filename**, Value `qa-test.exe`, Confidence **High** → **Add IOC** | Panel closes, success toast, new row appears as **Active** with Source **Manual** and Confidence **HIGH** |
| 6 | Click **Edit** on that new row | Panel opens with **IOC Type greyed out / not editable**; change the Description and **Update** → new description shows in the row |
| 7 | Click **Deactivate** on that row, confirm the prompt | Row flips to **Inactive** (dimmed) and its **Deactivate** button disappears; with **Show inactive** on it still lists |
| 8 | Log in as `msp_a`, try to open **IOC Management** | **No editable list** — screen is empty / blocked / errors (admin-only), not the full watchlist |
| 9 | Log in as `customer_a`, try to open **IOC Management** | Same — **no access** to the IOC watchlist |

**Report a fail with:** the row #, which login you used, and what you actually saw.
