Threatintelligenceindicator vs CommonsecurityLog:MaliciousIP - is one better than the other?

SocInABox sooooo in my experience

Commonsecuritylog is for different security appliances that you have integrated into you Sentinel workspace and have a common event format for log ingestion (usually CEF)

The Malicious values aren't better or worse then threat intelligence, the appliance....especially Zscaler will have its own Threat intelligence capability that is available within the product

If you have a dedicated Threat intelligence platform like recorded future, its just a matter of who gets the fastest threat IOC information, but much of a muchness really.

There are definite benefits for using both, The Zscaler (in this example) appliance is self contained, so if your Sentinel workspace ever had an outage (never has, but never say never) your Zscaler would still receive threat intelligence without disruption, also its good to correlate against a vendor who's ingesting it and verifying against there platform vs an open source threat intelligence platform like MISP for example.

So all you should need for threat intelligence within Sentinel is to enable the Threat intelligence analytic and that's it, any alerts will be surfaced from that special analytic type

I'm hoping this answers your question