Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top has several schemas defining Indicators of Compromise. The Schema is defined here:

While under IndicatorItemContext/search says it is xs:string, the actual list of search terms is listed here:

Is there something similar for IndicatorItem/condition? So far I'm only aware of "contains" and "is" but there doesn't seem to be a definitive list.

share|improve this question
up vote 1 down vote accepted

Unsure of where you can get a list from, but the IOC Editor may have visibly similar options. Meaning, you can browse the options to see what is available, and how it works. I'd also have a look at IOC Finder to see what options are available on that as well.

share|improve this answer
Hi, thanks the IOC editor has contains, is, contains not and is no, which I guess is definitive enough. I didn't think to use the IOCe! – A G May 30 '13 at 8:51
"is no" in your comment should be "is not" - so the list of options would be: "contains", "is" "contains not" and "is not". I'm just repeating this because without the quotes your comment is hard to read. – Scott Wilson Nov 7 '15 at 13:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.