Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

OpenIOC.org has several schemas defining Indicators of Compromise. The Schema is defined here:


While under IndicatorItemContext/search says it is xs:string, the actual list of search terms is listed here:


Is there something similar for IndicatorItem/condition? So far I'm only aware of "contains" and "is" but there doesn't seem to be a definitive list.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Unsure of where you can get a list from, but the IOC Editor may have visibly similar options. Meaning, you can browse the options to see what is available, and how it works. I'd also have a look at IOC Finder to see what options are available on that as well.

share|improve this answer
Hi, thanks the IOC editor has contains, is, contains not and is no, which I guess is definitive enough. I didn't think to use the IOCe! –  A G May 30 '13 at 8:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.