Check out
https://github.com/tylabs/dovehawk  dovehawk to integrate misp with zeek directly and handle content signatures in addition to indicators