heatmap-visualization

What problem does it solve?

Security teams need a compact and intuitive way to visualize how events distribute over time. This skill generates interactive heatmaps from Sentinel data, converting raw activity into a matrix that reveals temporal patterns and anomalies at a glance.

Core Features & Use Cases

• Generate time-based heatmaps from security data sources to identify peak periods and cross-entity patterns.
• Support enrichment integration to drill down on rows (e.g., IPs, apps, users) via click-to-expand threat intel panels.
• Use Case: Visualize sign-in activity by application over time or compare alert distributions across hosts to spot anomalies.

Quick Start

Start by querying aggregated data to build a dataset with fields row, column, and value, then render it as a heatmap with optional enrichment and color-scale customization. Use this flow to quickly generate a visual overview of activity patterns and threats.