diff --git a/src/primaite/notebooks/uc2_demo.ipynb b/src/primaite/notebooks/uc2_demo.ipynb
index c4fe4c9a..b1e12370 100644
--- a/src/primaite/notebooks/uc2_demo.ipynb
+++ b/src/primaite/notebooks/uc2_demo.ipynb
@@ -130,6 +130,9 @@
     "        - NETWORK_INTERFACES\n",
     "            - <nic_id 1-2>\n",
     "                - nic_status\n",
+    "                - nmne\n",
+    "                    - inbound\n",
+    "                    - outbound\n",
     "        - operating_status\n",
     "- LINKS\n",
     "    - <link_id 1-10>\n",
@@ -220,6 +223,14 @@
     "|1|ENABLED|\n",
     "|2|DISABLED|\n",
     "\n",
+    "NMNE (number of malicious network events) means, for inbound or outbound traffic, means:\n",
+    "|value|NMNEs|\n",
+    "|--|--|\n",
+    "|0|None|\n",
+    "|1|1 - 5|\n",
+    "|2|6 - 10|\n",
+    "|3|More than 10|\n",
+    "\n",
     "Link load has the following meaning:\n",
     "|load|percent utilisation|\n",
     "|--|--|\n",