https://community.cisco.com/t5/endpoint-security/how-to-search-bulk-ioc-s/m-p/4141113#M5620 <P>I'm not entirely sure what you meant by that, but you can see all of the Indicators of Compromise under Analysis&gt;Indicators in. the portal, or via <A href="https://console.amp.cisco.com/indicators" target="_blank" rel="noopener">this link</A>.&nbsp; You can also query them via the API <A href="https://api-docs.amp.cisco.com/api_actions/details?api_action=GET+%2Fv1%2Findicators&amp;api_host=api.amp.cisco.com&amp;api_resource=Indicator&amp;api_version=v1" target="_blank" rel="noopener">here</A>. Finally, you can search your events page for Indicators <A href="https://console.amp.cisco.com/dashboard/events#/events/show/{%22filters%22:{%22time%22:[%22week%22],%22tid%22:[1107296257]},%22sort_by%22:%22ts%22,%22sort_order%22:%22desc%22,%22name%22:%22%22}" target="_blank" rel="noopener">like this</A>.&nbsp; Hopefully that answers your question.<BR /><BR /></P> <P>Thanks,</P> <P>Matt</P> Tue, 25 Aug 2020 15:31:06 GMT Matthew Franks 2020-08-25T15:31:06Z https://community.cisco.com/t5/endpoint-security/how-to-search-bulk-ioc-s/m-p/4141067#M5619 <P>how to search bulk IOC's</P> Tue, 25 Aug 2020 14:50:32 GMT https://community.cisco.com/t5/endpoint-security/how-to-search-bulk-ioc-s/m-p/4141067#M5619 Pruthvirajnasagoni89418 2020-08-25T14:50:32Z https://community.cisco.com/t5/endpoint-security/how-to-search-bulk-ioc-s/m-p/4141113#M5620 <P>I'm not entirely sure what you meant by that, but you can see all of the Indicators of Compromise under Analysis&gt;Indicators in. the portal, or via <A href="https://console.amp.cisco.com/indicators" target="_blank" rel="noopener">this link</A>.&nbsp; You can also query them via the API <A href="https://api-docs.amp.cisco.com/api_actions/details?api_action=GET+%2Fv1%2Findicators&amp;api_host=api.amp.cisco.com&amp;api_resource=Indicator&amp;api_version=v1" target="_blank" rel="noopener">here</A>. Finally, you can search your events page for Indicators <A href="https://console.amp.cisco.com/dashboard/events#/events/show/{%22filters%22:{%22time%22:[%22week%22],%22tid%22:[1107296257]},%22sort_by%22:%22ts%22,%22sort_order%22:%22desc%22,%22name%22:%22%22}" target="_blank" rel="noopener">like this</A>.&nbsp; Hopefully that answers your question.<BR /><BR /></P> <P>Thanks,</P> <P>Matt</P> Tue, 25 Aug 2020 15:31:06 GMT https://community.cisco.com/t5/endpoint-security/how-to-search-bulk-ioc-s/m-p/4141113#M5620 Matthew Franks 2020-08-25T15:31:06Z https://community.cisco.com/t5/endpoint-security/how-to-search-bulk-ioc-s/m-p/4141674#M5621 <P>Hi Matthew,</P><P>&nbsp;</P><P>I mean searching custom IOC's as bulk at one short .</P><P>&nbsp;</P><P>Regards,</P><P>Pruthvi</P> Wed, 26 Aug 2020 13:44:02 GMT https://community.cisco.com/t5/endpoint-security/how-to-search-bulk-ioc-s/m-p/4141674#M5621 Pruthvirajnasagoni89418 2020-08-26T13:44:02Z https://community.cisco.com/t5/endpoint-security/how-to-search-bulk-ioc-s/m-p/4141709#M5622 <P>I'm still not 100% certain what you're asking but you can search all of your custom IOCs in the AMP Console <A href="https://console.amp.cisco.com/endpoint_ioc_documents" target="_blank" rel="noopener">here</A>.</P> <P>&nbsp;</P> <P>Thanks,</P> <P>Matt</P> Wed, 26 Aug 2020 14:26:36 GMT https://community.cisco.com/t5/endpoint-security/how-to-search-bulk-ioc-s/m-p/4141709#M5622 Matthew Franks 2020-08-26T14:26:36Z