config and cleanup
working 'ip to honeypot incident' transform