Entities

Every indicator extracted from incidents — IPs, accounts, hosts, hashes, URLs, domains — with when it was first and last seen, how many incidents it appeared in, how those incidents resolved, and what enrichment already knows about it.