Alerting on Retrospective IOC Matches

[will_garnett]

I'm trying to understand how alerting to SOAR works when there's a retrospective match on an IOC. Specifically, when a new IOC is added and it matches against an older event, at what point do the detection rules run, and how are alerts generated in this scenario?

Any help would be much appreciated.

[ionutm]

The creation of SOAR alerts are based on the detection rules firing in the SIEM. So if you create rule with logic that checks for a certain IOC and meets the criteria then that rule will fire a SIEM alert which is ingested into the SOAR.