---
title: Troubleshoot indicators of compromise
description: If indicator data is not appearing in the Indicators table after you installed a threat intelligence integration: Verify that the index storing indicator...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/1655/troubleshoot/security/indicators-of-compromise
products:
  - Elastic Cloud Serverless
  - Elastic Security
---

# Troubleshoot indicators of compromise
If indicator data is not appearing in the Indicators table after you installed a threat intelligence integration:
- Verify that the index storing indicator documents is included in the [default Elastic Security indices](/elastic/docs-content/pull/1655/solutions/security/get-started/configure-advanced-settings#update-sec-indices) (`securitySolution:defaultIndex`). The index storing indicator documents will differ based on the way you’re collecting indicator data:
  - **Elastic Agent integrations** - `logs_ti*`
- **Filebeat integrations** - `filebeat-*`
- Ensure the indicator data you’re ingesting is mapped to [Elastic Common Schema (ECS)](https://docs-v3-preview.elastic.dev/elastic/ecs/tree/main/reference).

<note>
  These troubleshooting steps also apply to the [Threat Intelligence view](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/1655/solutions/security/get-started/enable-threat-intelligence-integrations).
</note>