Proactive Threat Protection and Indicators of Compromise

Hi,

How actually does the Proactive Threat Protection (zero day protection) of SEP work? does it make use of indicators of compromise (such as those from openIOC) to detect malware and malicious activities? Or is it the Anti virus component that already is openIOC compliant?

thanks