geomap-visualization

What problem does it solve?

This skill helps security teams visualize geographic security data by rendering interactive world maps of attack origins from Sentinel data, enabling rapid understanding of where threats originate and how they distribute globally.

Core Features & Use Cases

• Interactive geomaps: render markers on a world map from Sentinel data with latitude/longitude coordinates or enriched IP data.
• MCP integration: leverages the Sentinel Geomap MCP App for visualization and drill-down enrichment.
• Use cases: map attack origins for honeypots, analyze geographic threat distribution, verify location-based security events, and support multi-IP investigations with country context.

Quick Start

1. Query Sentinel data to obtain coordinates for IPs (lat/lon) using a coordinate-bearing query.
2. If some IPs lack coordinates, run enrich_ips.py to fetch geolocation data.
3. Render the map using mcp_sentinel-geom_show-attack-map with the data and optional enrichment for interactive drill-down.