Great build. A next step for this setup could be CDB lists of known malicious domains, so DNS and proxy logs get matched against them with a simple rule. Daily CSV feeds fit that pattern well. The WhoisFreaks feed docs show the record format (whoisfreaks.com/documentation/threat-intelligence…), and there's a free sample to test the rule before wiring in a live feed.