---
title: "List indicators of compromise"
method: GET
path: "/api/v2/security/siem/ioc-explorer"
tags: ["Security Monitoring"]
---

# List indicators of compromise

`GET /api/v2/security/siem/ioc-explorer`

Get a list of indicators of compromise (IoCs) matching the specified filters.

## Query parameters

- `limit` integer
- `offset` integer
- `query` string
- `sort[column]` string
- `sort[order]` string
- `ocsf` boolean
- `worked_by` string
- `triage_state` 'not_reviewed' | 'reviewed' — Current triage state of the indicator.

## Response `200`

OK

- IoCExplorerListResponse — Response for the list indicators of compromise endpoint.
  - `data` IoCExplorerListResponseData — IoC Explorer list response data object.
    - `attributes` IoCExplorerListResponseAttributes — Attributes of the IoC Explorer list response.
      - `data` IoCIndicator[] — List of indicators of compromise.
        - `as_geo` IoCGeoLocation — Geographic location information for an IP indicator.
          - `city` string — City name.
          - `country_code` string — ISO country code.
          - `country_name` string — Full country name.
        - `as_type` string — Autonomous system type.
        - `benign_sources` IoCSource[], nullable — Threat intelligence sources that flagged this indicator as benign.
          - `name` string — Name of the threat intelligence source.
        - `categories` string[] — Threat categories associated with the indicator.
        - `first_seen` string, date-time — Timestamp when the indicator was first seen.
        - `id` string — Unique identifier for the indicator.
        - `indicator` string — The indicator value (for example, an IP address or domain).
        - `indicator_type` string — Type of indicator (for example, IP address or domain).
        - `last_seen` string, date-time — Timestamp when the indicator was last seen.
        - `log_matches` integer — Number of logs that matched this indicator.
        - `m_as_type` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT' — Effect of a scoring factor on the indicator's threat score.
        - `m_persistence` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT' — Effect of a scoring factor on the indicator's threat score.
        - `m_signal` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT' — Effect of a scoring factor on the indicator's threat score.
        - `m_sources` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT' — Effect of a scoring factor on the indicator's threat score.
        - `malicious_sources` IoCSource[], nullable — Threat intelligence sources that flagged this indicator as malicious.
          - `name` string — Name of the threat intelligence source.
        - `max_trust_score` 'RAISE_SCORE' | 'LOWER_SCORE' | 'NO_EFFECT' — Effect of a scoring factor on the indicator's threat score.
        - `score` number, double — Threat score for the indicator (0-100).
        - `signal_matches` integer — Number of security signals that matched this indicator.
        - `signal_tier` integer — Signal tier level.
        - `suspicious_sources` IoCSource[], nullable — Threat intelligence sources that flagged this indicator as suspicious.
          - `name` string — Name of the threat intelligence source.
        - `tags` string[] — Tags associated with the indicator.
        - `triage_state` 'not_reviewed' | 'reviewed' — Current triage state of the indicator.
        - `triaged_at` string, date-time — Timestamp when the indicator was last triaged.
        - `triaged_by` string — UUID of the user who last triaged the indicator.
      - `metadata` IoCExplorerListResponseMetadata — Response metadata.
        - `count` integer — Total number of indicators matching the query.
      - `paging` IoCExplorerListResponsePaging — Pagination information.
        - `offset` integer — Current pagination offset.
    - `id` string — Unique identifier for the response.
    - `type` string — Response type identifier.

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)