What was OpenIOC originally designed to enable?

• A. MANDIANT's products to codify intelligence in order to rapidly search for potential security breaches.
• B. A SOC ticketing system
• C. A secure file transfer protocol
• D. A threat intelligence marketplace

Answer: (A)

OpenIOC is an XML-based framework that lets analysts describe indicators of compromise as machine-readable tests. It was created by Mandiant to allow their security products to codify threat intelligence and automatically search across systems for matches, enabling rapid discovery of potential breaches. This approach turns intel into actionable checks that detection tools can run, rather than just human-readable notes. It’s not a ticketing system, a secure file transfer protocol, or a marketplace; its purpose is to standardize and automate how indicators of compromise are described and searched.