> ## Documentation Index
> Fetch the complete documentation index at: https://developer.kyberis.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Investigate an IOC

> Investigate IPs, domains, URLs, hashes, and email indicators with exact-string fidelity.

Use this workflow for observables from SIEM, EDR, firewall, email, or alerting systems.

## Workflow

1. Resolve the observable with concrete expected types: `ip`, `domain`, `url`, `hash`, or `email`.
2. Retrieve evidence for `observed_in_the_wild`, `malware_association`, `campaign_association`, or `actor_association`.
3. Pivot relationships to actors, campaigns, malware, sectors, countries, and related indicators. Use `relationship_types: ["ioc"]` for event-correlated IOC expansion, `sector` for targeted industries, and `country` for targeted countries.
4. Run `/v2/ioc-assessments` for disposition and recommended action on the submitted IOC.
5. Retry in exact `query` mode when canonicalization may lose URL or observable detail.

## Assessment vs. Expansion

IOC assessment and IOC expansion are separate calls. `/v2/ioc-assessments` assesses the submitted observable; `/v2/relationships` discovers related indicators and other pivots.

## Important Rule

Do not use `ioc` in `expected_types`. Expand IOC intent into concrete types.

```json theme={null}
"expected_types": ["ip", "domain", "url", "hash", "email"]
```

## Final Answer Shape

Lead with disposition and confidence. Then include related entities, evidence IDs, caveats, and recommended next actions such as block, hunt, monitor, or ignore.