add ips and dns callouts from threatanalyzer