Recognized action, specific, generalized, or theoretical, that an adversary might be expected to take in preparation for an attack.
Sources:
CNSSI 4009-2015
A technical artifact or observable that suggests an attack is imminent or is currently underway, or that a compromise may have already occurred.
Sources:
NIST SP 800-150
under Indicator