Which status represents suspicious patterns awaiting administrator analysis?

• A. Pending IOAs
• B. Archived IOAs
• C. Indicators
• D. Threat Hunting Service Tile

Answer: (A)

In this context, the important idea is how IOA (Indicator of Attack) items move through a triage workflow. When suspicious patterns are first detected but haven’t yet been reviewed, they’re marked as Pending. This status signals that they are awaiting administrator analysis to determine whether they represent a real threat or false positives. Archived IOAs, on the other hand, have already been reviewed and stored for reference, not awaiting review. Indicators refer to the actual patterns themselves, not their review state. The Threat Hunting Service Tile is a UI element, not a status for IOAs. So the status that best represents suspicious patterns awaiting administrator analysis is Pending IOAs.