SOC Attack Wall

The SOC Attack Wall app provides a visual security operations center dashboard that displays real-time and historical security events on an interactive map. The app aggregates security data from multiple sources including web application firewalls (WAF), intrusion detection systems (IDS), email security systems, identity providers, and VPN connections. Security events are collected through scheduled searches that run at regular intervals, storing results in a summary index for historical analysis and replay. The app includes a configuration dashboard for managing data sources, analyst information, and scheduling parameters through KV store collections. Daily totals and live event feeds provide both operational awareness and historical trending capabilities for security teams monitoring threats across their infrastructure.