An interactive 3D WebGL globe that renders geographic threat context in real time. Streams map tiles on demand, supports orbital-to-city zoom, and pins live or simulated threat markers across client infrastructure and attack origin zones.
The Problem
Security operations teams work with IP addresses, ASNs, and hostnames in flat tables. Geographic context exists — but it lives across 4 to 6 separate tools:
- Threat intel platform for IP geolocation
- SIEM for event origin
- Cloud console for region mapping
- Separate dashboard for client site locations
- Manual spreadsheet cross-referencing to connect them
The Solution
A browser-native 3D globe that streams map tiles progressively — no full texture pre-load, no WebAssembly dependency, no backend required for the base layer.
Markers are injected as a data layer on top of the globe surface:
- Attack origin clusters (IP geolocation enrichment output)
- Client infrastructure nodes (cloud regions, on-prem sites)
- Active incident pins with severity color coding
- Historical heatmap overlays for recurring threat zones
Use Cases
Cloud-Native MDR: Visualize where cloud workload alerts are originating geographically. Correlate AWS us-east-1 anomalies with concurrent attack clusters from the same region. Replace "check the SIEM, check the cloud console, check the threat intel feed" with one view.
CSPM Posture Mapping: Render every cloud resource across all regions on a single globe. Misconfigurations in APAC show up spatially alongside EU compliance zones. Gives security architects a posture view that maps to real operational geography.
SOC-as-a-Service Multi-Client: Each client's infrastructure appears as a pinned layer. Analysts see at a glance which client sites are in active threat zones during a campaign. Switch client context without losing spatial reference.
Offensive Security / Red Team: Map attack simulation paths geographically. Show clients where their exposure lives in relation to known threat actor infrastructure. Turns the post-engagement debrief from a table of findings into a spatial narrative.
Impact
- Collapses multi-tool geographic lookup into a single zoomable layer
- Reduces per-alert investigation time for location-based triage
- Gives MDR and cloud security teams spatial context at alert volume, not analyst pace
- Scales from single-client deployments to multi-region, multi-client overlays
Built by Kunsh Tanwar | ETXcyberops | [email protected]