I tested out the ThreatIntel features with TAXII and the MS Defender Threat Intelligence connectors. Features wise it's fine for the most part but I noticed that expired indicators still get refreshed every week and therefore never age out. Am I missing something? Ingestion rules don't impact refreshes either so I'm unable make use of that to handle them.