Which indicator signals that an attack is likely occurring?

• A. Indicators of Attack (IOA)
• B. Threat Hunting Service Tile
• C. Events
• D. Pending IOAs

Answer: (A)

Indicators of Attack (IOAs) are patterns of behavior that, when observed together, indicate an attack is likely underway. They link multiple signals—such as unusual process activity, credential use, and network connections—to reflect attacker techniques in a way that a single event cannot. This correlation makes IOAs a stronger, more actionable signal than any one event on its own, because it captures the purposeful sequence of actions attackers typically follow.

Pending IOAs are not yet a confirmed signal since they’re waiting validation, so they don’t indicate an attack by themselves. A Threat Hunting Service Tile is a UI element for exploring hunts, not a real-time indicator of compromise. So the concept that signals a likely attack is the presence of IOAs, since they represent correlated activity that aligns with attack techniques.