I'm working on a TA that pulls new domains from an API once per day and stores them in a KV store. I use this KV store in searches to monitor network logs for any events with domains that match domains from the KV Store.
Would it make sense to use an index to store these domains instead of a KV Store? Why or why not? what are the benefits/drawbacks of each?
The pros and cons of KV Store over indexes are much the same as those for lookup files vs indexes. KV Store adds the benefit of being able to modify individual rows or cells without re-writing the entire lookup. There are issues with using KV Store in a SHC, however.