Security analysts monitor networks to identify any signs of potential security incidents known as indicators of compromise (**IoC**) and protect networks from threats or attacks. **IoCs** are *observable evidence that suggests signs of a potential security incident*. IoCs chart specific pieces of evidence that are associated with an attack, like a file name associated with a type of malware. You can think of an IoC as evidence that points to something that's already happened, like noticing that a valuable has been stolen from inside of a car. To do this, they must understand the environment that network communications travel through so that they can identify deviations in network traffic. ### Indicators of attack (IoA) IoAs are the series of observed events that indicate a real-time incident. IoAs focus on identifying the behavioural evidence of an attacker, including their methods and intentions. Essentially, *IoCs help to identify the who and what of an attack after it's taken place*, while *IoAs focus on finding the why and how of an ongoing or unknown attack*. For example, observing a process that makes a network connection is an example of an IoA. The filename of the process and the IP address that the process contacted are examples of the related IoCs.