Теперь модифицируй код следующим образом. в Image записываются вычисления по его директории (там будет только одна цифра). в Class запиывается результат -  уыли sourcehostname включает в себя Director, то 1 иначе 0. Сортируй всё по Hostname и нормализуй числовые данные фрейма. вот код (def classify_image(image, user):
    if 'Director' in user:
        return 3

    executable_extensions = ['.exe', '.dll', '.sys', '.bat', '.cmd', '.ps1', '.vbs']
    if 'System32' in image or 'AppData' in image:
        if any(image.lower().endswith(ext) for ext in executable_extensions):
            return 3
        else:
            return 2
    elif any(image.lower().endswith(ext) for ext in executable_extensions):
        return 1
    else:
        return 0

def process_record(data, output_file):
    source = data.get('_source', {})
    event_data = source.get('event_data', {})
    user = event_data.get('User', '')
    sourcehostname = event_data.get('SourceHostname', '')
    event_id = source.get('event_id', '')
    thread_id = source.get('thread_id', '')
    image = event_data.get('Image', '')
    utc_time = event_data.get('UtcTime', '')
    classification = classify_image(image, user)
    src_or_user = sourcehostname if sourcehostname else user

    record = {
        "SourceHostname_User": src_or_user,
        "EventId": event_id,
        "ThreadId": thread_id,
        "Image": image,
        "UtcTime": utc_time,
        "Class": classification
    }
    
    output_file.write(orjson.dumps(record) + b'\n')
    
    return record

input_file_name = 'Logs.json' 
output_file_name = 'processed_records.jsonl'  

processed_count = 0

with open(input_file_name, 'rb') as input_file, open(output_file_name, 'wb') as output_file:
    for line in input_file:
        try:
            data = orjson.loads(line)
            process_record(data, output_file)
            processed_count += 1
        except KeyError as e:
            print(f"KeyError encountered: {e}")
        
        if processed_count % 10000 == 0:
            print(f'Processed {processed_count} records…')

print(f'Total processed records: {processed_count}')) а теперь предоставлю строку из данных файла Logs(Где таких сотни миллионов ({"_index": "winlogbeat-2023.11.23", "_type": "doc", "_id": "mu99-YsB5ZnwQua3q9mk", "_score": null, "_source": {"process_id": 4328, "event_data": {"User": "ISS-RESHETNEV\\VilshanskiySI", "DestinationIp": "10.0.8.77", "SourceHostname": "n743879.iss-reshetnev.ru", "DestinationPortName": "-", "UtcTime": "2023-11-22 23:55:23.961", "ProcessGuid": "{160589a2-7444-6551-e700-000000002d00}", "RuleName": "-", "Image": "C:\\Users\\VilshanskiySI\\AppData\\Local\\Programs\\TrueConf\\Client\\TrueConf.exe", "SourceIsIpv6": "false", "ProcessId": "11300", "DestinationPort": "4307", "Initiated": "true", "SourceIp": "10.14.8.219", "SourcePort": "55838", "SourcePortName": "-", "DestinationIsIpv6": "false", "Protocol": "tcp", "DestinationHostname": "trueconf.npopm.ru"}, "opcode": "\u0421\u0432\u0435\u0434\u0435\u043d\u0438\u044f", "record_number": "25091745", "beat": {"hostname": "ELC-SRV01", "version": "6.6.1", "name": "ELC-SRV01"}, "user": {"type": "User", "identifier": "S-1-5-18", "domain": "NT AUTHORITY", "name": "\u0421\u0418\u0421\u0422\u0415\u041c\u0410"}, "type": "wineventlog", "@version": "1", "level": "\u0421\u0432\u0435\u0434\u0435\u043d\u0438\u044f", "thread_id": 1100, "event_id": 3, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "tags": ["beats_input_codec_plain_applied"], "task": "Network connection detected (rule: NetworkConnect)", "version": 5, "@timestamp": "2023-11-23T00:03:37.473Z", "computer_name": "n743879.iss-reshetnev.ru", "source_name": "Microsoft-Windows-Sysmon", "host": {"name": "ELC-SRV01"}, "log_name": "Microsoft-Windows-Sysmon/Operational", "message": "Network connection detected:\nRuleName: -\nUtcTime: 2023-11-22 23:55:23.961\nProcessGuid: {160589a2-7444-6551-e700-000000002d00}\nProcessId: 11300\nImage: C:\\Users\\VilshanskiySI\\AppData\\Local\\Programs\\TrueConf\\Client\\TrueConf.exe\nUser: ISS-RESHETNEV\\VilshanskiySI\nProtocol: tcp\nInitiated: true\nSourceIsIpv6: false\nSourceIp: 10.14.8.219\nSourceHostname: n743879.iss-reshetnev.ru\nSourcePort: 55838\nSourcePortName: -\nDestinationIsIpv6: false\nDestinationIp: 10.0.8.77\nDestinationHostname: trueconf.npopm.ru\nDestinationPort: 4307\nDestinationPortName: -"}, "sort": [1700697817473]}
)