I'm trying to understand how alerting to SOAR works when there's a retrospective match on an IOC. Specifically, when a new IOC is added and it matches against an older event, at what point do the detection rules run, and how are alerts generated in this scenario?
Any help would be much appreciated.
LinkedIn
Twitter
