---
module: aria.ioc-management
title: IOC Management
tab: Customer
order: 10
audience: customer
---

Your watchlist of known threat indicators. Use this screen to review, add, and retire the Indicators of Compromise (IOCs) HiveIQ watches for across your fleet — for example a malicious filename, service, or address flagged in an FBI FLASH or FS-ISAC alert.

## 🔎 What you can do here
- **Filter by type** — open the Filters panel and pick one or more IOC types (Filename, MD5, Registry Key, Directory, Service Name, IP, File Path). Selected filters show as chips you can remove.
- **Show inactive** — tick this in the Filters panel to include retired indicators alongside active ones.
- **Add an IOC** — click **+ Add IOC** to add a new indicator to the watchlist.
- **Edit** — update an existing indicator's description, source, confidence, or expiry.
- **Deactivate** — retire an indicator so it no longer triggers detections (you'll be asked to confirm).

## 📝 Adding or editing an IOC
1. Click **+ Add IOC** (or **Edit** on a row).
2. Choose the **IOC Type** and enter the **Value** — both are required (for example `atmii.exe` or `C:/Temp/atr/`).
3. Optionally add a **Description**, a **Source Reference** (such as an FBI FLASH number), a **Confidence** level, and an **Expires** date.
4. Click **Add IOC** / **Update** to save.

> The IOC Type can't be changed once an indicator has been created — deactivate it and add a new one if the type was wrong.

## 📊 What you're looking at
Each row is one indicator on the watchlist:
- **Type** — what kind of indicator it is (filename, address, registry key, and so on).
- **Value** — the exact thing being watched for.
- **Description** — a short note on what it means.
- **Source** — where it came from: FBI FLASH, FS-ISAC, or a Manual entry.
- **Confidence** — how strong the indicator is: High, Medium, or Low.
- **Added** / **Expires** — when it was added and when it stops being watched (if an expiry was set).
- **Status** — Active indicators trigger detections; Inactive ones are retired and dimmed in the list.

> **Good to know:** Deactivating never deletes an indicator — it simply stops detections. Turn on **Show inactive** any time to review or edit past entries.
