diff --git a/NIST_Data_Leakage_Case/NIST_Data_Leakage_02._WinEvt_XML_Python.pptx b/NIST_Data_Leakage_Case/NIST_Data_Leakage_02._WinEvt_XML_Python.pptx
index 6c6b72a..fcd3c20 100644
Binary files a/NIST_Data_Leakage_Case/NIST_Data_Leakage_02._WinEvt_XML_Python.pptx and b/NIST_Data_Leakage_Case/NIST_Data_Leakage_02._WinEvt_XML_Python.pptx differ
diff --git a/NIST_Data_Leakage_Case/py_version/10_list_partitions.pptx b/NIST_Data_Leakage_Case/py_version/10_list_partitions.pptx
index 7e9cc11..dcd6e9d 100644
Binary files a/NIST_Data_Leakage_Case/py_version/10_list_partitions.pptx and b/NIST_Data_Leakage_Case/py_version/10_list_partitions.pptx differ
diff --git a/NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml/__pycache__/pymymodule.cpython-39.pyc b/NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml/__pycache__/pymymodule.cpython-39.pyc
new file mode 100644
index 0000000..e80275d
Binary files /dev/null and b/NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml/__pycache__/pymymodule.cpython-39.pyc differ
diff --git a/NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml/py_tutorial.ipynb b/NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml/py_tutorial.ipynb
new file mode 100644
index 0000000..74ed22e
--- /dev/null
+++ b/NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml/py_tutorial.ipynb
@@ -0,0 +1,179 @@
+{
+ "cells": [
+  {
+   "cell_type": "code",
+   "execution_count": 1,
+   "metadata": {},
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "10\n",
+      "ubalt\n"
+     ]
+    }
+   ],
+   "source": [
+    "# Declare a variable and initialize it\n",
+    "a = 10\n",
+    "print(a)\n",
+    "# re-declaring the variable works\n",
+    "a = 'ubalt'\n",
+    "print(a)"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 3,
+   "metadata": {},
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "x is greater than y\n",
+      "x is 10 and y is 1\n"
+     ]
+    }
+   ],
+   "source": [
+    "x,y =10,1\n",
+    "\n",
+    "if(x < y):\n",
+    "\tst= \"x is less than y\"\n",
+    "else:\n",
+    "\tst= \"x is greater than y\"\n",
+    "print (st)\n",
+    "print (\"x is {} and y is {}\".format(x,y))"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 8,
+   "metadata": {},
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "Jan\n",
+      "Feb\n",
+      "Mar\n",
+      "April\n",
+      "May\n"
+     ]
+    }
+   ],
+   "source": [
+    "#use a for loop over a collection\n",
+    "months = [\"Jan\",\"Feb\",\"Mar\",\"April\",\"May\"]\n",
+    "# This is a set months = {'January', 'February', 'March', 'April'}\n",
+    "for m in months:\n",
+    "\tprint(m)"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 16,
+   "metadata": {},
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "Jan\n",
+      "Feb\n"
+     ]
+    }
+   ],
+   "source": [
+    "# create a month set and \n",
+    "# use a for loop over the  collection\n",
+    "month_set = set()\n",
+    "element1 = \"Jan\"\n",
+    "element2 = \"Feb\"\n",
+    "\n",
+    "month_set.add(element1)\n",
+    "month_set.add(element2)\n",
+    "\n",
+    "for m in month_set:\n",
+    "\tprint(m)"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 13,
+   "metadata": {},
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "The square of 2 is 4.\n"
+     ]
+    }
+   ],
+   "source": [
+    "#define a function\n",
+    "def square(x):\n",
+    "  \treturn x*x\n",
+    "\n",
+    "input = 2\n",
+    "output = square(input)\n",
+    "print(\"The square of {} is {}.\".format(input, output))"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": 14,
+   "metadata": {},
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "25\n"
+     ]
+    }
+   ],
+   "source": [
+    "# Import pymymodule as mm (an abbreviation)\n",
+    "import pymymodule as mm\n",
+    "\n",
+    "# Use the square function\n",
+    "result = mm.square(5)\n",
+    "print(result)  # This will print: 25\n"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "metadata": {},
+   "outputs": [],
+   "source": []
+  }
+ ],
+ "metadata": {
+  "kernelspec": {
+   "display_name": "Python 3",
+   "language": "python",
+   "name": "python3"
+  },
+  "language_info": {
+   "codemirror_mode": {
+    "name": "ipython",
+    "version": 3
+   },
+   "file_extension": ".py",
+   "mimetype": "text/x-python",
+   "name": "python",
+   "nbconvert_exporter": "python",
+   "pygments_lexer": "ipython3",
+   "version": "3.9.16"
+  },
+  "orig_nbformat": 4
+ },
+ "nbformat": 4,
+ "nbformat_minor": 2
+}
diff --git a/NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml/py_tutorial.txt b/NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml/py_tutorial.txt
new file mode 100644
index 0000000..507c5d3
--- /dev/null
+++ b/NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml/py_tutorial.txt
@@ -0,0 +1 @@
+The content will be overwritten each time!
\ No newline at end of file
diff --git a/NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml/pymymodule.py b/NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml/pymymodule.py
new file mode 100644
index 0000000..ddd2ad2
--- /dev/null
+++ b/NIST_Data_Leakage_Case/py_version/pycode/security_evt_xml/pymymodule.py
@@ -0,0 +1,3 @@
+# define a function
+def square(x):
+    return x * x