There are two related things which are relevant for this discussion:
1) We need UUIDs per event to avoid loops - to be defined what "event" does mean in this context (https://github.com/certtools/intelmq/issues/901) 2) We need some kind of aggregation (https://github.com/certtools/intelmq/issues/751) - inside or outside of intelmq 3) We need some possibility to link between related events, which have been splitted because of multiple "alternative" values (more IPs per domain etc) (e.g. https://github.com/certtools/intelmq/issues/543 https://github.com/certtools/intelmq/issues/373)
ad 1) Should the UUID be inherited for alternative values as described in 3)? IMHO no, but that requires a second UUID Different tools which are working on data collected with intelmq can then link these events together using the UUIDs.
Once we can do 3) and have a possibility to save basic lists for e.g. abuse contacts, then the issue for Alexander is solved too (with an adapted harmonization).
Sebastian