The Geo Visualization widget displays various aspects of alerts with a world map. You can zoom in on a particular country or region of interest.
The widget provides brief information about various attacks' origins and their types. The attacker's IP address is mapped on the world map using its latitude and longitude information provided by the location services used in the platform.
.PNG "geo-viz.PNG")
The left panel displays the following statistics:
Top Victims subnets: Top 5 victims' subnet addresses based on the alert count are displayed. Clicking on any address filters the chart data for the corresponding subnet.
Top Attacks: Top attack types based on the alert count are displayed.
Top Attack Origins: Top countries from where the attacks originated are displayed.
Chart interactions
Hover over any country on the chart to see the country's statistics. When you click the country, the right panel displays a donut chart for multiple attack types and lists down all the attackers' and victims' IP addresses associated with the country. You can click on any attack type to navigate to the respective alerts page.
Zoom in to display the attacker's nodes located at their latitude and longitude.
Zooming in further shows all the located nodes that are tagged with the city information, if available.
If several nodes are positioned at the same latitude and longitude on the map, the tooltip shows aggregated information for all nodes.
Hover over the attackers' list in the right panel to see the attacker-specific statistics.