reorg demo data into events/alerts/attackers to allow for constant stream of all