FortiGuard IOC

Network Insights > FortiGuard IOC detections are suspicious URLs and IPs that are flagged by FortiGuard. This anomaly discovery depends on FortiNDR look up in the FortiGuard IOC service. Apart from URL category (e.g. malicious websites), you will also see an Extra Info column for any campaign name involved (e.g. Solarwind, Locky Ransomware).

The FortiGuard IOC monitor displays the following information:

Column	Description
URL Category	The UR Category.
IOC	The Indications of Compromise service.
Anomaly Severity	The anomaly severity (Not Anomaly, Info, Low, Medium, High or Critical).
Count (Historic)	The total number of times the anomaly was observed.
Count (Past week)	The total number of times the anomaly was observed during the past week .
First Timestamp	The timestamp for the first time the anomaly was detected.

For information about muting rules, see NDR Muting.