diff --git a/ioc-logs.md b/ioc-logs.md
new file mode 100644
index 0000000..9538e52
--- /dev/null
+++ b/ioc-logs.md
@@ -0,0 +1,3 @@
+```
+/net/gfa-syslog/var/log/remote/*
+```
\ No newline at end of file