Dear IntelMQ-Devs,
whilst analysing our current setup and possible requirements, we discovered that an aggregation of events within IntelMQ might be a reasonable thing to do.
In [1] I sketched how this might work. I'd be glad if you could find the time to comment on this approach and participate in the discussion.
[1] https://github.com/certtools/intelmq/issues/751
Best regards
Dustin