How to Encode IDS Alert log into SDR?

If you encode your input data properly with semantics, the TM can give you live indications of how anomalous the current state is. It is harder to classify the sequence, but you can do it if you have lots of labeled examples of states and you train a model on each state (the model with the lowest anomaly is the classification). The predictions from the TM are not usually accurate unless you have a very stable pattern. Judging from your description of your data, I doubt you will be successful with predicting future patterns. If you can focus on anomalies you’ll have the most success.

Speaking of semantics, as you decide how to encode your data, you should definitely read Encoding Data for HTM Systems. Some of the fields you mention could be categories, but should they have overlap? That’s something you need to decide.