What is the difference between an IOA and an IOC?
IOCs are clues that suggest a system has been breached, while IOAs are patterns of behavior that indicate an ongoing attack. IOCs are based on known malicious activity, whereas IOAs are based on the methods and techniques used by attackers.