At @hack_lu @Rand is up presenting on using your bloody indicators for something…. Determine a course of action (MISP course of action taxonomy choice). If you do take action, can you deploy blocks widely at scale fast, and can you roll that back if you mess something up? Is access to your MISP instances secured? Dennis is releasing #Cratos which is a caching proxy shim to sit in front of your MISP instance to improve perf and lock down access to your MISP.