Large corporations and government agencies are continually bombarded by malicious network attacks through the cyber infrastructure. One common method to identify and assess the impacts of these malicious activities is through the monitoring and analysis of network flow data. While already somewhat aggregated, the data can quickly become overwhelming – a billion flow records a day for large organizations is not abnormal. We have integrated our visual analytics toolkit with network flow data to provide a seamless workflow for computer network defense analysts. This integration can facilitate the learning process of novice analysts and make expert analysts more productive.