▸Live Attack Origins · World Viewgeo-locating…
acquiring world map…
sensor
sev-1
sev-2
recon
ACTIVE ATTACKERS
▸ click an attacker on the map or list
to inspect signature · impact · action
▸Honeypot Services · OpenCanary8 services · xpot
▸Threat Operations · Live Attack Globe3D · animated arcs → NYC sensor
LIVE THREAT DETECTIONS · signature / impact / action
▸Shared Botnet Infrastructure · Country ↔ CountryCowrie · countries linked by shared credentials · 24h
▸Network Topology · Logical Map3-node VPC · live status · click a node
Click a node for its software stack & ports.
▸NetFlow · Top Talkersall sources
▸Source Deviation Trackerrecent 1h vs 3h moving avg
-25% to +25% normal
>+25% elevated
<-25% dropped
low volume
▸Campaign Correlation · Events → Actorshoneypot · 6h
▸Attacker Geography · Country × HourXpot honeypot · top source countries · 24h
▸Attacker Sessions · Honeypot TTPsCowrie · last 24h · creds, commands, payloads
Credential Harvest
Commands Executed
Captured Payloads
▸Credential Flow · Username → Password → OutcomeCowrie · user → pass → success/fail · 24h
▸DNS Query Flow · Sankeysource → top resolved domains · 1h
▸Zeek Notices · NDR Alertsbrute-force · scans · TLS · malware
▸Credentials Tried · Password Cloudcowrie brute-force
▸Attack Rate · sessions / 15m over 12h—
▸Top Attack SignaturesET threats · 24h
▸Alert Categoriessuricata
▸MITRE ATT&CK Techniquessuricata
▸Fleet Uptime · Heartbeat—
▸Host Vitals · Metricbeatavg · last 3m
▸Honeypot Sessions · Cowrie—
▸Top DNS · Zeek (mirror)last 1h
▸Suricata · Protocol Mix—
▸Filebeat · Honeypot AnalyticsCowrie · last 24h
session activity · events / hour
▸Auditbeat · Host AuditFIM + audit · last 24h
failed vs successful logins · per 2h
▸Auditbeat · Live Event Streamtailing…
▸Container Fleet · Docker Status—
▸Filebeat · Live Event Streamxtratum journald
▸Login Attempts · Real NodesAuditbeat · 24h
attempts per username · failed / success
live login stream · newest first