All IOC's must have a "Field" assigned to them. They will be seen either in the IOC itself or using DevTools viewing the IOC. Incorrect "Field" will not produce results on the Investigate page.
Example:
Searching Investigate page for an IP using "netconn_ipv4:152.70.253.207" may trigger results and will work as a watchlist.
"Field" would equal netconn_ipv4 and could be visible in the watchlist IOC or if not defined in the IOC it will be visible in DevTools, not both.
Finding the "Field" value in DevTools
- Open DevTools
- Navigate to a Watchlist
- Navigate to a Report
- Select an IOC
- In the URL after the word report the IOC ID will be listed
- Find and select the IOC ID in DevTools
- Expand the iocs_v2 and drill down to the IOC and "Field" name
It will be defined as null if it is in the actual IOC.