you don't need to see my wacky internal terminology for a simple log analyzing tool

1 files changed, 6 insertions, 12 deletions

diff --git a/README.md b/README.md
index f0fe695..ee60abf 100644
--- a/README.md
+++ b/README.md
@@ -13,18 +13,12 @@ Options:
 -v, --verbose         Make the output more verbose (print abridged logs for all logins where commands are run, not just the interesting ones)
 -V, --verboser        Make the output even more verbose (print timestamp, event id, and message (if applicable) for all events)
 -W, --verbosest       Make the output even more verboserer (just group the input log by session id and dump it to pretty-printed JSON)
--P, --pings           Print only "empty pings"
--F, --fails           Print only failed logins
--L, --logins          Print only "login pings"
--C, --commands        Print only "command pings"
--E, --eventful        Print only the cool interesting sessions that aren't any of that other stuff.
+-P, --pings           Include only connections where no authentication attempt was made
+-F, --fails           Include only failed logins
+-L, --logins          Include only successful logins where no commands were run
+-C, --commands        Include only logins where only this list of basic test commands were run: ['uname', 'nproc', 'echo']
+-E, --eventful        Include only the cool interesting sessions that aren't any of that other stuff
 -r, --redact-ip       Redact IP addresses by converting them to 16-character hashes
 -i, --filter-ip FILTER_IP
                       Filter data to a specific IP or censored hash thereof
-```
-
-# Terminology
-
-- "Empty ping": Client connected and made no attempt to log in
-- "Login ping": Client logged in successfully and did nothing
-- "Command ping": Client logged in successfully and only ran `uname`, `nproc`, and/or `echo`. In my experience "command pings" comprise most insances of a client successfully logging in and then bothering to run any commands
\ No newline at end of file
+```
\ No newline at end of file