[ ] Reuse training code to parse data but instead of training, use some sort of search or parse to filter for specifically data from the known attacker IP and victim IPs, listed in the Element
[ ] Data exploration after that
[ ] Model re-evaluation (somewhat dependent on #25)
data extraction workflow for offline training