An automated indicator is a metric computed by a system from collected data to show performance, health, or deviation from a baseline. In cybersecurity, these indicators are often built from telemetry such as login activity, network flows, endpoint events, or service response times. Common examples include failed-login rates, unusual data transfer volumes, or sudden changes in process behavior.
Automated indicators matter because they turn large amounts of raw data into signals that analysts can act on quickly. Defenders use them in monitoring, SIEM, EDR, and anomaly-detection systems to spot threats, prioritize alerts, and measure whether controls are working. Attackers may try to evade or distort them by blending in with normal activity, delaying noisy actions, or corrupting the source data. That is why indicators must be based on reliable inputs and interpreted in context, not treated as proof on their own.