Many organizations have experienced damages of targeted attacks. In detection of targeted attacks inside network, indicators such as C&C server domain and IP address can be useful. For this reason, information sharing scheme has been developed globally during the past years. One of the examples is a standardized format for automated indicator sharing, STIX, introduced by MITRE.However, STIX had not been widely implemented in Japan until recently. According to a survey conducted in NCA (Nippon CSIRT Association) in 2015, only 3% of members have used STIX for threat information exchange at that time. To cultivate a better understanding of STIX in Japan, the University of Tokyo has provided trainings for CII companies and academia. As a result, STIX has gradually become popular in Japan.As STIX-formatted indicator exchange increases, however, there are new challenges. In detection of cyber attacks, users are required to compare increasing number of shared indicators against a large amount of logs stored in their network, which consumes quite a lot of resources. Indicators serves two purposes: 1) detecting communication that occurred from their own network to suspicious hosts in the past, and 2) blocklisting malicious hosts so that potential damage is prevented. In order to satisfy both of the function, the University of Tokyo developed a tool analyzing logs effectively by integrating logs into Elasticsearch.Our tool compares proxy logs with STIX format indicators upon the following triggering actions: -When logs are imported (in real-time)Compare logs with preset blacklist stored in Elastic Stack, and raise an alert if any matches-When indicators are imported (on-demand)Compare indicators with past logs, and raise an alert if any matchesAdd indicators to blacklistWe will present how our tool is effective in detecting attacks and reducing incident response time.