---
title: Troubleshoot indicators of compromise
description: If indicator data is not appearing in the Indicators table after you installed a threat intelligence integration: Verify that the index storing indicator...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8035/troubleshoot/security/indicators-of-compromise
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available
---

# Troubleshoot indicators of compromise
If indicator data is not appearing in the Indicators table after you installed a threat intelligence integration:
- Verify that the index storing indicator documents is included in the default Elastic Security indices ([`securitySolution:defaultIndex`](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/advanced-settings#kibana-siem-settings)). The index storing indicator documents will differ based on the way you’re collecting indicator data:
  - **Elastic Agent integrations** - `logs_ti*`
- **Filebeat integrations** - `filebeat-*`
- Ensure the indicator data you’re ingesting is mapped to [Elastic Common Schema (ECS)](https://docs-v3-preview.elastic.dev/elastic/ecs/tree/main/reference).

<note>
  These troubleshooting steps also apply to the [Threat Intelligence view](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8035/solutions/security/get-started/enable-threat-intelligence-integrations).
</note>