I'd love to see some support from the SIEM for dynamic block lists for firewalls.