heatmap-visualization

You can generate interactive heatmaps from security data by querying aggregated datasets containing row, column, and value fields, then rendering them with customizable color scales to reveal temporal patterns at a glance.

Yes, this skill automates creating time-based heatmaps from MCP-enabled Sentinel data, converting raw activity into matrices to identify peak periods, attack patterns, and cross-entity anomalies.

Yes, it supports enrichment integration, allowing you to drill down on specific rows like IPs or users via click-to-expand threat intelligence panels directly within the heatmap interface.

You configure rows and columns by defining predefined queries or schemas that aggregate your security data source, mapping specific entities like applications or hosts to visualize their distribution over time.

Generating a cross-entity heatmap allows you to compare alert distributions across hosts by applying color scales to temporal matrices, making it easy to spot anomalies and peak activity periods.

You need predefined queries or schemas to build the required row, column, and value dataset from your MCP-enabled Sentinel data, which typically involves using KQL to aggregate the underlying security analytics.