Besides incoming blacklisted connections, external to internal traffic isn't super useful in any of our analysis modules. And incoming blacklisted connections is of questionable usefulness as well since the things that normally scan everything on the internet will also normally end up on blacklists. We're not trying to detect someone attacking coming in. We're trying to detect already compromised

Repro is in Brim v0.14.0.

There's a link to the ZQL docs from the pull-down menu via Help > Query Syntax Docs that works as I'd expect, in that it opens up the docs in my browser. However, I recently noticed (per the attached video) that there's also a "Syntax docs" option available in the vertical "..." menu to the right of the search bar. When clicked, I find I can't move the window, no