heatmap-visualization

Generate interactive time-based heatmaps from MCP-enabled Sentinel data.

231|64|Updated Dec 16, 2025

Search Tags:#MCP #enrichment #data-visualization #Sentinel #KQL #heatmap #security-analytics

Ready to run

npx skills add https://github.com/SCStelz/security-investigator --skill heatmap-visualization

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: heatmap-visualization
Source: https://github.com/SCStelz/security-investigator/tree/main/.github/skills/heatmap-visualization
Command: npx skills add https://github.com/SCStelz/security-investigator --skill heatmap-visualization

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams need a compact and intuitive way to visualize how events distribute over time. This skill generates interactive heatmaps from Sentinel data, converting raw activity into a matrix that reveals temporal patterns and anomalies at a glance.

Core Features & Use Cases

Generate time-based heatmaps from security data sources to identify peak periods and cross-entity patterns.
Support enrichment integration to drill down on rows (e.g., IPs, apps, users) via click-to-expand threat intel panels.
Use Case: Visualize sign-in activity by application over time or compare alert distributions across hosts to spot anomalies.

Quick Start

Start by querying aggregated data to build a dataset with fields row, column, and value, then render it as a heatmap with optional enrichment and color-scale customization. Use this flow to quickly generate a visual overview of activity patterns and threats.

Frequently Asked Questions about heatmap-visualization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I visualize security analytics data as a heatmap?▼

You can generate interactive heatmaps from security data by querying aggregated datasets containing row, column, and value fields, then rendering them with customizable color scales to reveal temporal patterns at a glance.

Can I create time-based heatmaps from Sentinel data?▼

Yes, this skill automates creating time-based heatmaps from MCP-enabled Sentinel data, converting raw activity into matrices to identify peak periods, attack patterns, and cross-entity anomalies.

Does heatmap visualization support enrichment data for threat intel?▼

Yes, it supports enrichment integration, allowing you to drill down on specific rows like IPs or users via click-to-expand threat intelligence panels directly within the heatmap interface.

How do I configure rows and columns for security heatmaps?▼

You configure rows and columns by defining predefined queries or schemas that aggregate your security data source, mapping specific entities like applications or hosts to visualize their distribution over time.

What is the best way to compare alert distributions across hosts?▼

Generating a cross-entity heatmap allows you to compare alert distributions across hosts by applying color scales to temporal matrices, making it easy to spot anomalies and peak activity periods.

Do I need KQL to generate time-based security heatmaps?▼

You need predefined queries or schemas to build the required row, column, and value dataset from your MCP-enabled Sentinel data, which typically involves using KQL to aggregate the underlying security analytics.