Correlate RDP event logs with BlueKeep IOC and normal-pattern references to produce precise `findings.txt` outputs. Use when tasks require counting targeted vulnerable hosts, identifying true attack sources, and inferring exploit success from mixed benign/malicious telemetry.
rdp_events.log-style files against IOC/reference docs.ms_t120/MS_T120_BIND + anomaly notes), then subtract normal-pattern traffic.unique(DST_IP in exploit attempts) ∩ unique(unpatched inventory IPs).UNKNOWN.test_correct_attack_sources.ATTACK_SOURCES.ms_t120 hit as an attacker inflated false positives.sed output hid full distribution details; full-file parsing is required.VULNERABLE_SYSTEMS: ATTACK_SOURCES: SUCCESSFUL_EXPLOITS: ATTACK_SOURCES.pytest /tests/test_outputs.py -rA) when available.awk/Python) for structured field extraction.