How to Interpret IOC Lookup Results — What a Record (or No Record) Means
How to read an IOC Lookup result correctly: what a matching record means, what no record means, false positives, confidence, and when to escalate to a full investigation. Never treat an indicator lookup as a threat verdict.
Quick Answer
An IOC lookup answer has two parts: whether OpenTrojan has a record for the indicator, and whether that record is verified. A matching record raises suspicion and tells you where it was seen; an empty result only means no known record — absence of evidence is not evidence of safety. Never equate a lookup result with a threat verdict.
Definition
IOC Lookup result interpretation is the discipline of reading an indicator match (or miss) in context — record provenance, confidence, freshness and correlation — before making any security decision.
Answer first
An IOC lookup returns two facts only: whether a record exists, and how that record is qualified. Match ≠ malicious. No record ≠ safe.
1. What a matching result means
A match means OpenTrojan has seen this indicator in at least one record — a malware write-up, campaign page, CVE advisory or vendor advisory — and links it to related entities (malware family, actor, campaign). Use the linked entities to orient: who, what and where the indicator has been observed.
2. What a matching result does NOT mean
A match does not prove the indicator is active in your environment, does not prove any host is compromised, and does not prove attribution. It is a starting point for collection, correlation and investigation — not a conclusion.
3. What “no verified intelligence found” means
The indicator has no record in OpenTrojan. That is a coverage statement, not a safety statement:
- The indicator may be new, brief, or niche.
- Your organisation may be the only one that has seen it — that is exactly when you investigate.
- Never tell a user “it’s clean” because a lookup returned nothing.
4. False positives and false negatives
- False positive: a domain reused by both malicious and benign services, an IP in a shared hosting range, or a hash that happens to match a record for a different sample. Check the entity description and references before acting.
- False negative: a fresh indicator, a slow blocklist, or a domain that was clean at the time of the record. Freshness matters: check the record’s observed timestamp.
5. Confidence and source quality
Every record has provenance (source) and confidence. Prefer records from vendor advisories, CISA and first-party malware analyses. Treat passively-seen records as leads, not proof. If confidence is low, collect more evidence before action.
6. When to investigate
Escalate when the indicator: appears in a log or mail you are already triaging, is correlated with a second independent signal, or is directly related to a confirmed family/campaign. One unrelated hit is a lead; two independent hits make a case.
7. Next steps
- Keep the defanged value and the record URL in your notes.
- Correlate the indicator with logs (proxy, DNS, mail) in your environment.
- Start an investigation to track correlation and conclusions.
- Re-check later — indicators change over time.
8. Tools that help
- IOC Lookup — normalise, defang and check indicators.
- Hash Checker — confirm hash type before lookup.
- URL Reputation Checker — domain/URL records when the IOC is a URL.
- Investigation Workspace — record evidence and verdict.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.