Besides incoming blacklisted connections, external to internal traffic isn't super useful in any of our analysis modules. And incoming blacklisted connections is of questionable usefulness as well since the things that normally scan everything on the internet will also normally end up on blacklists. We're not trying to detect someone attacking coming in. We're trying to detect already compromised

As of Brim commit 6f7c3be, larger numbers are printed with commas in them.

While this is convenient for readability in the UI, if the user single-clicks then hits a hotkey to copy its contents into a paste buffer, when pasted it comes out with the comma intact, i.e. 10,411. Since