Custom IOA (Indicator of Attack) is typically where regular expressions (Regex) are employed to create detections or take preventative actions. IOAs are behavioral indicators of an attack, and they often utilize pattern matching and advanced techniques like Regex to identify malicious activity.