in that case, it has no place in an open source detection ecosystem imo and should be actioned against data like existing threat intel (on the server wrt the logging pipeline)