Which data element contains suspicious patterns detected in event data flow?

• A. IOAs
• B. Pending IOAs
• C. Archived IOAs
• D. Indicators

Answer: (D)

Suspicious patterns detected in the stream of events are represented as indicators. An indicator is a signal or data element that captures these patterns and flags potential issues for further investigation. While indicators of attack (IOAs) describe specific attack-pattern signals, the general data element that holds the detected patterns in the event data flow is the indicator itself. The other options refer to IOAs in various states (pending, archived) or to a broader term, but they do not directly denote the primary data element that contains the detected patterns.