Besides incoming blacklisted connections, external to internal traffic isn't super useful in any of our analysis modules. And incoming blacklisted connections is of questionable usefulness as well since the things that normally scan everything on the internet will also normally end up on blacklists. We're not trying to detect someone attacking coming in. We're trying to detect already compromised

The command line currently created by Brim when launching zqd (such as in GA Brim tagged v0.18.0) prevents remote access because the option -l localhost:9867 specifies localhost. This makes sense as a default. However, if is this were shortened to merely -l :9867, the zqd would be prepared to accept remote connections. Therefore we could make this an option that could be enabled in the