Attackers don't do one bad thing; they do a sequence of bad things. Grouping events together by a common field (like a Session ID or IP) is essential.
The `transaction` command is useful for seeing the chronological flow of events, while `stats list()` is often faster for simply summarizing them.