Which element shows actions taken by monitored programs on computers?

• A. Pending IOAs
• B. Events
• C. Indicators
• D. Archived IOAs

Answer: (B)

Events are the records that show what programs actually did on the computer, capturing concrete actions like a process starting, a file being written or read, registry changes, and network connections, all with timestamps. That direct log of activity provides the observable behavior of monitored programs, making it the best fit for showing actions taken on endpoints.

Pending IOAs are actions that have not yet been evaluated as part of an Indication of Attack, so they don’t represent completed activities. Archived IOAs are past detections saved for reference, not ongoing actions. Indicators refer to signs or signals of potential compromise rather than the actual actions performed by programs.