A piece of forensic data that signals a potential intrusion or malicious activity on a system. Implementations They are often documented in a certain format. Popular formats are: OpenIOC YARA STIX