Reconnaissance host=firewall block 192.168.1.128 | stats count rt-30m rt Exploitation host=snort "192.168.1.128,7001,10.10.10.128" | stats count rt-30m rt Pivot host=snort "192.168.1.128,7002,10.10.10.128" | stats count rt-30m rt Actions host=snort "192.168.1.128,7003,10.10.10.128" | stats count rt-30m rt host=firewall block 192.168.1.128 | timechart count rt-30m rt host=snort "192.168.1.128,7001,10.10.10.128" | timechart count rt-30m rt host=snort "192.168.1.128,7002,10.10.10.128" | timechart count rt-30m rt host=snort "192.168.1.128,7003,10.10.10.128" | timechart count rt-30m rt