Pieces of forensic data, such as data found in system log entries or files, that identify potentially malicious activity on a system or network. indicators of compromise (IOC)