geomap-visualization

Render interactive world maps of attack origins from Sentinel coordinate data.

231|64|Updated Dec 16, 2025

Search Tags:#mcp #visualization #geospatial #sentinel #geomap #attack-origins #ip-enrichment

Ready to run

npx skills add https://github.com/SCStelz/security-investigator --skill geomap-visualization

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: geomap-visualization
Source: https://github.com/SCStelz/security-investigator/tree/main/.github/skills/geomap-visualization
Command: npx skills add https://github.com/SCStelz/security-investigator --skill geomap-visualization

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps security teams visualize geographic security data by rendering interactive world maps of attack origins from Sentinel data, enabling rapid understanding of where threats originate and how they distribute globally.

Core Features & Use Cases

Interactive geomaps: render markers on a world map from Sentinel data with latitude/longitude coordinates or enriched IP data.
MCP integration: leverages the Sentinel Geomap MCP App for visualization and drill-down enrichment.
Use cases: map attack origins for honeypots, analyze geographic threat distribution, verify location-based security events, and support multi-IP investigations with country context.

Quick Start

Query Sentinel data to obtain coordinates for IPs (lat/lon) using a coordinate-bearing query.
If some IPs lack coordinates, run enrich_ips.py to fetch geolocation data.
Render the map using mcp_sentinel-geom_show-attack-map with the data and optional enrichment for interactive drill-down.

Frequently Asked Questions about geomap-visualization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I visualize Sentinel attack origins on an interactive world map?▼

Map attack origins from Sentinel data by rendering interactive geomaps with latitude and longitude coordinates. This geographic threat visualization requires the MCP Geomap App and an optional enrichment payload for drill-down.

How do I plot attack origins when my Sentinel IPs are missing latitude and longitude coordinates?▼

Plot attack origins by running ipinfo enrichment to fetch missing geolocation data for your IPs. Once enriched, render the map using the MCP Geomap App with the newly acquired coordinates and enrichment payload.

What do I need to render geographic threat distribution maps for honeypot data?▼

Mapping geographic threat distribution requires the Sentinel Geomap MCP App, coordinate data from Sentinel, and an enrichment payload. This setup enables interactive drill-down for multi-IP investigations with country context.

Can I use MCP Geomap to support multi-IP location-based security investigations?▼

MCP Geomap supports multi-IP location-based investigations by rendering global attack origins on an interactive map. It integrates with Sentinel data and ipinfo enrichment to provide country context and drill-down capabilities.

Does the geomap visualization skill work without an enrichment payload?▼

Geomap visualization requires an enrichment payload to accompany the map data for interactive drill-down. While basic rendering uses lat/lon coordinates from Sentinel, enrichment provides necessary location-based context.