Problem
Live threat-intelligence visualization that plots inbound attack origins on a world map, streams a feed of enriched IOCs, and ranks the most active malicious source regions.
Threat IntelOSINTData VizIOC EnrichmentReactCase study / interactive demo
Case study
From problem to working system
My role
Security engineer and full-stack developer
Solution
Live threat-intelligence visualization that plots inbound attack origins on a world map, streams a feed of enriched IOCs, and ranks the most active malicious source regions.
Architecture
The implementation combines the following technologies and system concerns.
Threat IntelOSINTData VizIOC EnrichmentReact
How it was built
- Built the feed and map to degrade gracefully when an upstream source is unavailable, showing staleness rather than inventing data.
Security decisions
- Streamed enriched indicators of compromise and plotted attack origins on a world projection, updating continuously rather than on refresh.
- Enriched each indicator with geolocation, ASN, and observed attack type so the map communicates behaviour, not just volume.
Major challenges
- Streamed enriched indicators of compromise and plotted attack origins on a world projection, updating continuously rather than on refresh.
- Enriched each indicator with geolocation, ASN, and observed attack type so the map communicates behaviour, not just volume.
- Ranked the most active source regions and networks, which is the view that actually informs a blocking decision.
Verified evidence
Results and measurable impact
- Ranked the most active source regions and networks, which is the view that actually informs a blocking decision.
- Aggregated repeated events per source so a single noisy actor cannot dominate the visualisation.
- Built the feed and map to degrade gracefully when an upstream source is unavailable, showing staleness rather than inventing data.
- Rendered with transform-only animation to keep a continuously updating visualisation smooth.
No separate numeric outcome is documented, so this section shows shipped technical evidence without inventing metrics.
Screenshots and access
Product view
Interactive Demo
A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.
threatmap.zainkhalilkhan.com
ThreatMap
Global attack telemetry
ThreatMapWorkspace2 updates
ThreatMapGLOBAL ATTACK OBSERVATORY
STREAMING
Attacks / min
0
Blocked
0
Auto-blocked
0
Unique sources
0
Active now
0
● defended assets
Filter
Live IOC feed
Awaiting events…
Top attacking regions
Collecting…
Top targeted assets
Collecting…
Zain Khalil Khan
Client-side sandbox. State is in memory and nothing is sent to a server.