Hi Sazer, it's good to have you with us!
Generally speaking, .blacklists and lists of IOCs are constructed in Energy Logserver in a way to work with existing information with optimal performance usage.
If you would constantly compare data to IOC inside database, then yes - that could impact performance, but since we have IOC in two places (database and flat files), there's no point of doing that and engage database in the process.
When Logstash is starting, it loads IOC dictionaries into its memory and we are using that mechanism to parse IOC verification. In that way we don't have to engage database into this process, thus avoiding huge amount of queries.
As for using this in alerting - I'd say that best way is to use Blacklist-IOC Alert type. This is specially modified blacklist type, which can handle big files/dictionaries to compare values.
Example:
# (Required)
# The field used to build set from documents in response and compare with blacklist-ioc field
compare_key: dst.ip
# (Required)
# !yaml directive supported
blacklist-ioc:
- "!yaml /etc/logstash/lists/misp_ip.yml"
Let me know if you have any further questions.
