Suspicious IP Automated Report

Customer Builders Mutual Insurance Company is requesting a way to output suspicious IPs to a report, on a cadence that can automatically be kept up to date as TI feeds change. Output is for updating firewall lists, and automatically have the list be kept current (old items removed and new items replaced).