Which type of indicators are obtained from data extracted from a security incident, such as hash values and regular expressions?

Which type of indicators are obtained from data extracted from a security incident, such as hash values and regular expressions?

• A. Atomic indicators
• B. Computed indicators
• C. Behavioral indicators
• D. Host-Based Indicators

Answer: (A)

Indicators that come from a security incident are often discrete, individual data points used to identify or confirm malicious activity. These are atomic indicators: each item stands on its own and can be used directly for detection or containment. Hash values are classic examples because they uniquely identify a file, and results from regular expressions yield specific strings or tokens that point to artifacts discovered during the incident. Together, they represent raw evidence pieces you can match across systems and logs. Behavioral indicators describe patterns of activity over time (like beaconing or unusual login behavior) rather than a single data artifact. Computed indicators are derived or composite, created by combining multiple data points into a new metric. Host-based indicators refer to artifacts tied to a particular host. The question’s examples—hash values and regex-derived data—are best categorized as atomic indicators.

Indicators that come from a security incident are often discrete, individual data points used to identify or confirm malicious activity. These are atomic indicators: each item stands on its own and can be used directly for detection or containment. Hash values are classic examples because they uniquely identify a file, and results from regular expressions yield specific strings or tokens that point to artifacts discovered during the incident. Together, they represent raw evidence pieces you can match across systems and logs.

Behavioral indicators describe patterns of activity over time (like beaconing or unusual login behavior) rather than a single data artifact. Computed indicators are derived or composite, created by combining multiple data points into a new metric. Host-based indicators refer to artifacts tied to a particular host. The question’s examples—hash values and regex-derived data—are best categorized as atomic indicators.