I put together a small project called Global Threat Atlas. It started out simple, and 500+ commits later it turned into something production-ready. It can be deployed today in Azure commercial subscriptions.
This is built with an operations center in mind. It works well as a glanceable wallboard, but you can also interact with it to explore different layers, data points, and patterns as needed.
Live demo:
https://jolly-cliff-0f92c201e.2.azurestaticapps.net
GitHub repo:
https://github.com/AndrewBlumhardt/global-threat-atlas
The focus is on mapping risk to location. Instead of working through rows of data, you can see activity distributed globally, spot clusters, and notice when something looks out of place. It gives a quick sense of what is happening, while still allowing deeper exploration.
You can layer in different datasets, both static and dynamic, including data sourced from Sentinel. This makes it easy to shift views, highlight specific types of activity, and explore patterns from different angles.
There are a few features built in to support that:
- News feed integration for additional context
- IP lookup and enrichment
- VirusTotal lookup support
- Search and filtering
- Custom layer support
- Auto-scroll for display scenarios
- LLM prompt generation for follow-on analysis
The functionality stays focused, but flexible enough to adapt to different use cases.
The architecture is straightforward. A Static Web App frontend, Azure Maps for visualization, blob storage for datasets, and a lightweight Azure Function to handle access and keys. It keeps things simple, cost-effective, and secure without adding unnecessary complexity. The goal is to take data you already have and make it easier to see, especially in an operations center setting where quick context matters.
I originally planned to support Azure Government environments as well, but ran into a few feature parity gaps. That will likely come later as a separate release.