<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-security-data-visualization
description: >-
  Design and build security data visualizations including dashboards, attack
  graphs, heatmaps, and anomaly plots that translate complex telemetry into
  actionable situational awareness for SOC analysts and leadership.
domain: cybersecurity
subdomain: security-data-engineering
tags:
  - visualization
  - dashboards
  - grafana
  - kibana
  - attack-graphs
  - situational-awareness
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1087", "T1018"]
  frameworks: ["NIST 800-92", "CIS Controls v8"]
  tools: ["python3", "grafana", "kibana", "matplotlib", "plotly"]
---

# Building Security Data Visualization

## Overview

Effective security visualization transforms raw telemetry into cognitive tools.
Well-designed dashboards reduce mean time to detect (MTTD) by surfacing anomalies
visually and providing drill-down paths from summary metrics to raw events.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Data source (SIEM/data lake) | Underlying telemetry to visualize |
| Visualization platform | Grafana, Kibana, or custom |
| Security domain knowledge | Understand what metrics matter |
| Color accessibility awareness | Ensure readability for all analysts |

## Key Concepts

- **Preattentive attributes**: Color, size, position processed before conscious thought
- **Dashboard hierarchy**: Executive summary → operational detail → investigation
- **Anomaly highlighting**: Baseline comparison with deviation markers
- **Drill-down paths**: Click from summary to filtered raw events
- **Refresh cadence**: Match update frequency to operational tempo

## Workflow

### Step 1: Define Dashboard Taxonomy

```python
DASHBOARD_LAYERS = {
    "executive": {
        "refresh": "1h",
        "metrics": ["risk_score_trend", "open_incidents", "mttr", "compliance_posture"],
        "audience": "CISO, board",
    },
    "operational": {
        "refresh": "5m",
        "metrics": ["alert_volume", "triage_queue", "top_sources", "detection_coverage"],
        "audience": "SOC manager",
    },
    "tactical": {
        "refresh": "30s",
        "metrics": ["live_alerts", "event_rate", "anomaly_scores", "investigation_context"],
        "audience": "SOC analyst",
    },
}
```

### Step 2: Build Core Visualizations

```python
import plotly.graph_objects as go

def build_alert_heatmap(hourly_counts: list[list[int]]) -> go.Figure:
    """Build hourly alert volume heatmap by day of week."""
    fig = go.Figure(data=go.Heatmap(
        z=hourly_counts,
        x=[f"{h:02d}:00" for h in range(24)],
        y=["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"],
        colorscale="YlOrRd",
    ))
    fig.update_layout(
        title="Alert Volume Heatmap",
        xaxis_title="Hour",
        yaxis_title="Day",
    )
    return fig
```

### Step 3: Implement Grafana Dashboards

```json
{
  "dashboard": {
    "title": "SOC Operations Overview",
    "panels": [
      {
        "type": "timeseries",
        "title": "Alert Rate (5m windows)",
        "targets": [{
          "expr": "rate(security_alerts_total[5m])",
          "legendFormat": "{{severity}}"
        }]
      },
      {
        "type": "stat",
        "title": "Open Critical Incidents",
        "targets": [{
          "expr": "security_incidents_open{severity='critical'}"
        }]
      }
    ]
  }
}
```

### Step 4: Validate Dashboard Effectiveness

```bash
node agent.js audit --dashboard soc_operations --check-coverage
node agent.js generate --template executive --datasource elasticsearch
```

## Detection

```yaml
title: Security Data Visualization Detection
id: d31663b5-8422-45f1-b4ca-a08564f711c7
status: experimental
description: Detects suspicious activity related to building security data visualization techniques in security data engineering context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*building*security*"
  condition: selection
level: medium
tags:
  - attack.t1087
  - attack.t1018
  - attack.collection
falsepositives:
  - Data pipeline ETL processes during scheduled batch windows
```

## Verification

| Check | Method |
|---|---|
| All critical metrics covered | Dashboard audit against metric catalog |
| Drill-down paths functional | Click-through testing from summary to detail |
| Refresh rates appropriate | No stale data during active incidents |
| Color accessibility | WCAG 2.1 contrast ratio compliance |

## References

- [Grafana Dashboard Best Practices](https://grafana.com/docs/grafana/latest/dashboards/)
- [SANS SOC Dashboard Design](https://www.sans.org/)
- [NIST SP 800-92 — Log Management](https://csrc.nist.gov/publications/detail/sp/800-92/final)
