(ip.src in $risk_ip) or (cf.threat_score gt 30)