Besides incoming blacklisted connections, external to internal traffic isn't super useful in any of our analysis modules. And incoming blacklisted connections is of questionable usefulness as well since the things that normally scan everything on the internet will also normally end up on blacklists. We're not trying to detect someone attacking coming in. We're trying to detect already compromised

For #828, I thought of any string Brim might treat specially. "(empty)" is one of them. Given a toy data set containing a string value of "(empty)", Brim will not render the string. This is true of both scalars and container members.

Consider empty.log, which looks like:

#separator \x09
#set_separator	,
#empty_field	(empty)
#unset_field	-
#path	string
#fields	ts	id	scalar	record.scal