How to create a correlation search from a threat intelligence feed

[smote01]

I wanted to take malicious IP's/URL's that the threat Intel feeds provides and compare them against logs/traffic we see in Splunk and create an alert.