Rainstorm shows IDS alert activity within a network over a 24 hour period.  The techniques chosen for this tool were a rainfall plot and a zoom window interface.  The rainfall plot technique wraps the Y-axis into multiple axes, allowing it to be very long compared to the X-axis.  It uses the Y-axis to represent the IP address space being monitored (in the example it is around 3 /16 networks or ~200,000 IP addresses).  The X-axis is time.  It uses color to represent the IDS alert severity.