skills.rest
msandbu
msandbuCOMMUNITY
Explore all skills by this author →
GitHub

heatmap-visualization

Generate interactive heatmaps from Microsoft Sentinel data using KQL-aggregated inputs.

2|Updated Mar 4, 2026
Search Tags:#data analysis#visualization#threat hunting#pattern identification#heatmap#microsoft sentinel
One-click install
npx skills add https://github.com/msandbu/sentinelday --skill heatmap-visualization-msandbu
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: heatmap-visualization
Source: https://github.com/msandbu/sentinelday/tree/main/.github/skills/heatmap-visualization
Command: npx skills add https://github.com/msandbu/sentinelday --skill heatmap-visualization-msandbu

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill transforms complex datasets into easily understandable heatmap visualizations, helping to identify patterns, trends, and anomalies over time or across different dimensions.

Core Features & Use Cases

  • Interactive Heatmaps: Generates dynamic heatmaps for various data types.
  • Pattern Identification: Ideal for spotting peak activity, attack trends, or user behavior patterns.
  • Use Case: Visualize failed sign-in attempts across different IP addresses and hours of the day to quickly identify potential brute-force attacks.

Quick Start

Use the heatmap-visualization skill to create a heatmap of sign-in activity by application and hour for the last 24 hours.

Frequently Asked Questions about heatmap-visualization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I visualize Microsoft Sentinel data patterns using a heatmap?▼

You can visualize Microsoft Sentinel data patterns by running KQL queries to aggregate data into row, column, and value formats, which this skill then transforms into interactive heatmap visualizations.

Can I use heatmaps for threat hunting and identifying brute-force attacks in Sentinel?▼

Heatmaps support threat hunting by visualizing failed sign-in attempts across IP addresses and hours, helping you quickly identify peak activity, attack trends, and potential brute-force attack patterns.

Do I need to write KQL queries to generate interactive heatmaps from Sentinel data?▼

Yes, you need to write KQL queries to aggregate your Microsoft Sentinel data into row, column, and value formats, which are required to display the interactive heatmap visualizations.

How does heatmap visualization enrich IP-based analysis with threat intelligence?▼

Heatmap visualization enriches IP-based analysis by cross-tabulating activity by entity and hour, integrating threat intelligence data to help spot anomalies and identify malicious IP behavior patterns.

Related Skills

Explore More Data & Analytics Skills→
skinred78skinred78
1

firebase-cloudrun

Deploy Flask apps to Google Cloud Run with Firebase Hosting URLs.

Community
Advanced
robit-manrobit-man

sigma-hunting

Applies Sigma detection rules to logs and converts them to Elasticsearch, Splunk, and grep queries.

Community
Advanced
msandbumsandbu
2

ioc-investigation

Investigate IP addresses, domains, URLs, and file hashes with threat intelligence correlation.

Community
Advanced
yangqiongyangqiong

Data Visualization Skill

Generate line, bar, scatter, histogram, box, and heatmap plots with Matplotlib and Seaborn.

Community
Intermediate