At CrowdSec, we collect millions of behavior signals from agents globally. We use MongoDB to store, index, and query this data fast enough to push live IP blocklists. It powers our real-time threat intel pipeline and helps us scale open source defense across thousands of users. Here's the MongoDB case study. I'm happy to answer any questions about the setup, schema, or scaling!
https://www.mongodb.com/solutions/customer-case-studies/crowdsec
Click to Open Code Editor