# \#misp

**URL:** https://taggartinstitute.org/tag/misp/37.md

[Latest](https://taggartinstitute.org/latest.md) · [Categories](https://taggartinstitute.org/categories.md) · [Tags](https://taggartinstitute.org/tags.md)

---

## [Questions about IOC ingestion and at-scale comparison engine for enterprise SIEM using MISP](https://taggartinstitute.org/t/questions-about-ioc-ingestion-and-at-scale-comparison-engine-for-enterprise-siem-using-misp/204)

<div class="topic-metadata">

**Author:** [@HGB](https://taggartinstitute.org/u/HGB)\
**Replies:** 2\
**Last updated:** [March 4, 2026, 2:41pm UTC](https://taggartinstitute.org/t/questions-about-ioc-ingestion-and-at-scale-comparison-engine-for-enterprise-siem-using-misp/204 "2026-03-04T14:41:52Z")

</div>

I see a ton of companies just selling IOC feeds and there are quite a few free ones, but I rarely see anyone talking about how to actually use those feeds. Sure there are some that you can just feed into your firewall an…