Which indicator type should you use?

Last Updated on November 14, 2021 by Admin

You receive a security bulletin about a potential attack that uses an image file.

You need to create an indicator of compromise (IoC) in Microsoft Defender for Endpoint to prevent the attack.

Which indicator type should you use?

  • a URL/domain indicator that has Action set to Alert only
  • a URL/domain indicator that has Action set to Alert and block
  • a file hash indicator that has Action set to Alert and block
  • a certificate indicator that has Action set to Alert and block