Firepower Discovery Event "Host IOC set" What does this mean?

[DannyDulin]

I cannot for the life of me find anything more about the Discovery Event “Host IOC Set” except for:

This event is generated when an IOC (Indications of Compromise) is set for a host and generates an alert.

What does that mean?

Many of the events have a category of Impact 2 Attack; Event Type: Impact 2 Intrusion Event - web-application-attack.

What do I do about this?

[balaji.bandi]

This means any of the Host comprimised -  it will generate alert to your SIEM and generate Ticket to investigate the Host.

This will generate various co-relation of data.

https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/fpmc-config-guide-v60_chapter_01110011.html

What do I do about this?  < - if you get this alerts you need to investigate this Host ( any malware or any other infected ) - generally take out from network and investigate, and suggest method always re-image to protect the network.

[DannyDulin]

How do I determine what has compromised the host?

[balaji.bandi]

The logs will generate  - depending on the config and deployment.

You need to read more about deployment of IPS