Which action adds IOCs to customize detections for a new attack?

The "initiate Endpoint IOC scan feature" is used to actively scan endpoints for *existing* IOCs, not to *add* new IOCs into the system for future detection.

Cisco Secure Endpoint provides a dedicated feature for uploading and managing custom Indicators of Compromise (IOCs), such as file hashes, IP addresses, or domain names, which allows administrators to define specific patterns for detection and customize the endpoint's threat intelligence for new or targeted attacks.

While IOCs are used in custom detections, the most direct and specific action to *add* the IOCs themselves is typically through an upload mechanism into a dedicated IOC management feature, rather than a generic "add custom advanced detection."

Modifying the base policy might enable or reference custom detections, but it is not the direct action for *adding* the actual IOCs themselves; IOCs are usually defined and managed in a separate section before being applied via policies.