IOA

IOA:

Indicator Of Attack

---

[...] refer to the series of behaviors that a cybercriminal exhibits prior to executing a cyberattack. The intent of cybercriminals may be evaluated during the research stage of the cyberattack kill chain — where they investigate potential entry points, and collect data about the company, users and technology systems in place. Indicators of attack are not so much a static description of the attacker, but a dynamic profile of how an attacker interacts with your technologies and users. https://www.splunk.com/en_us/blog/learn/ioa-indicators-of-attack.html