From 63ea5478ab4fc39ffde3359983c332098fd318b6 Mon Sep 17 00:00:00 2001
From: Chris McCarthy <chris.mccarthy@methods.co.uk>
Date: Wed, 28 Feb 2024 13:56:19 +0000
Subject: [PATCH] #2238 - Updated uc2_demo.ipynb to explain the NMNE in
 observation space

---
 src/primaite/notebooks/uc2_demo.ipynb | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/primaite/notebooks/uc2_demo.ipynb b/src/primaite/notebooks/uc2_demo.ipynb
index c4fe4c9a..b1e12370 100644
--- a/src/primaite/notebooks/uc2_demo.ipynb
+++ b/src/primaite/notebooks/uc2_demo.ipynb
@@ -130,6 +130,9 @@
     "        - NETWORK_INTERFACES\n",
     "            - <nic_id 1-2>\n",
     "                - nic_status\n",
+    "                - nmne\n",
+    "                    - inbound\n",
+    "                    - outbound\n",
     "        - operating_status\n",
     "- LINKS\n",
     "    - <link_id 1-10>\n",
@@ -220,6 +223,14 @@
     "|1|ENABLED|\n",
     "|2|DISABLED|\n",
     "\n",
+    "NMNE (number of malicious network events) means, for inbound or outbound traffic, means:\n",
+    "|value|NMNEs|\n",
+    "|--|--|\n",
+    "|0|None|\n",
+    "|1|1 - 5|\n",
+    "|2|6 - 10|\n",
+    "|3|More than 10|\n",
+    "\n",
     "Link load has the following meaning:\n",
     "|load|percent utilisation|\n",
     "|--|--|\n",