Rule name: "Skopnix: Request to known-malicious URL"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [any]
  - and when any of URL is contained in any of Reference Set - "Skopnix: Malicious URLs"
  - and NOT when an event matches any of the following BB:Skopnix Known-Good Exclusions
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix URL match".
FP-safety: BB:Skopnix Known-Good Exclusions = RFC1918 + the customer's known-good destinations; the set only ever holds skopnix high-confidence, multi-source, warninglist-clean indicators (time-to-live 60 days, timeout on last seen).