> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mythic-c2.net/llms.txt
> Use this file to discover all available pages before exploring further.

# 7. Get IOC

## What is it?

Since C2 profiles can vary pretty wildly, it's not always easy to know what potential indicators of compromise exist for any given c2, especially when you consider how it's modified for a very specific agent. The thing that would know *best* what kinds of IOCs exist for a given agent configuration for a C2 profile would be the C2 profile itse.f

## Where is it?

The dropdown actions button for any payload will have an option to generate IOCs from the corresponding built-in C2 profiles.

## What does it look like?

<Tabs>
  <Tab title="Python">
    ```python theme={"system"}
    async def get_ioc(self, inputMsg: C2GetIOCMessage) -> C2GetIOCMessageResponse:
        """Generate IOCs for the network traffic associated with the specified c2 configuration

        :param inputMsg: Payload's C2 Profile configuration
        :return: C2GetIOCMessageResponse detailing some IOCs
        """
        response = C2GetIOCMessageResponse(Success=True)
        response.IOCs = []
        return response
    ```
  </Tab>

  <Tab title="Golang">
    ```go theme={"system"}
    GetIOCFunction             func(message C2GetIOCMessage) C2GetIOCMessageResponse
    ```

    ```go theme={"system"}
    package c2structs

    // C2_GET_IOC STRUCTS

    // C2GetIOCMessage given the following C2 configuration, determine the IOCs that a defender should look for
    type C2GetIOCMessage struct {
       C2Parameters
    }

    // IOC identify the type of ioc with Type and the actual IOC value
    // An example could be a Type of URL with the actual IOC value being the configured callback URL with URI parameters
    type IOC struct {
       Type string `json:"type" mapstructure:"type"`
       IOC  string `json:"ioc" mapstructure:"ioc"`
    }

    // C2GetIOCMessageResponse the resulting set of IOCs that a defender should look out for based on the
    // C2GetIOCMessage configuration
    type C2GetIOCMessageResponse struct {
       Success bool   `json:"success"`
       Error   string `json:"error"`
       IOCs    []IOC  `json:"iocs"`
    }
    ```
  </Tab>
</Tabs>