Index or Lookup Emerging Threats or AlienVault OTX

Currently I have my Emerging Threats being run through Suricata, and the OTX being run through Zeek on my SecurityOnion which then feeds to my Splunk instance.  I seem to have already broken my Kibana (will have to research that next - side panels run, but its all white space where the actual data should be). 

After reading a few articles: 
Malware Analysis
IDS alert challenge
Splunk Enterprise Security
IDS rules for PulledPork

Now I know that SecurityOnion uses pulledpork currently for its rule management, but I believe in future versions it will be moving to Suricata-update (well at least for Suricata).  But that does not matter currently. 

Emerging Threats updates a file called downloaded.rules, and OTX created a file called otx.dat, these both hold the rules which can be either parsed into an index or TSV/CSV out into a lookup table. 

Currently, I am trying to decide which way would be the most beneficial to most me, and other users of my system. 

I also think there is at least another file that goes with the Snort VRT which goes into further details based on the SID and is called the opensource.gz  For Emerging Threats it is called SID-Descriptions-ETOpen.json.gz which I think provides the same information for that rule set.

I am leaning towards putting the rules into an index, but I could be swayed either way, or to not even try this, but I think this has potential for analysts who try and hunt, to be able to look back at what signatures are hit on, and not have to Google every one of them.   

Intel Threats ingesting into SecurityOnion

Earlier today I re-created my SecurityOnion VM, and turned on the port mirroring on my TP-LINK switch.  One thing I still need to figure out is if I need to mirror both ingress/egress on separate ports or is it a 1-for-1. 

I signed up for IBM X-Force Intel feeds, AlienVault OTX Threat Feeds, and Critical Threat feeds.  Currently, I only set up on the AlienVault OTX threats as I am not sure if I can have multiple threats loaded.  I think I can just have not had time to read through everything. 

I used the guide found at SecurityOnion OTX Intel Threat setup with Bro(Zeek). 

Overall the instructions provided by the SecurityOnion team were easy to follow and ran into no errors.  One thing I would have like but understand from a security point of view was the input of the API key.  It a blank field and no cursor movement to see if you have put in a specific number of characters.  I used cut/paste on my second attempt (first one I tried to hand copy from my main machine to the VM) 

Now to sit back and watch Bro and Suricata report back what's going on my network.  Next project will be adding a Splunk forwarder.  I know there is Kibana, but I would like to have the option for both. 

Can anyone think of any other type of files/feeds I should be ingesting in Bro/Suricata?   Or another application to run on SecurityOnion?