its something i wish i had back in my SOC days. no more trying to correlate IP of suss traffic with responsible hostname, or pouring through process logs and trying to match up timestamps