Netwala — Threat Intelligence Dashboard
A proof-of-concept security operations console built to win the work: could one screen tell an analyst what to look at first, out of 575 open threats?
Server lens, 24-hour window. Threat volume mapped onto infrastructure topology rather than listed in a table — bubble size carries magnitude, position carries location in the estate.
Time as a control, not a preset — a scrubbable 24h range sits above everything it filters.
Volume summary ordered by kill-chain progression: recon → suspected compromise → attack → anomaly.
The pivot canvas. Same data, three lenses: Threat, Source IP, Server.
Supporting evidence — open/closed split, attack geography, highest-risk hosts, each dismissible.
-
The problem behind the brief
The ask was "a security dashboard." The real problem was triage under volume: analysts were reading log tables to find the one host that mattered. Pattern recognition was being done by a human doing a machine's job.
-
Framing with the team
We reduced the analyst's first thirty seconds to three questions — how bad, where, who — and made them the design's organising constraint. Everything that didn't answer one of the three came off the screen.
-
The structural decision
Three questions became three lenses over one canvas — Threat, Source IP, Server — instead of three destinations in a nav. The analyst changes what they're looking through, never where they are.
-
The core interaction move
Replacing the server table with a spatial topology map. Bubbles sized by threat volume, grouped by tier — database, application, web, proxy, FTP. Concentration becomes visible before a single number is read.
-
Visual system
Dark canvas, one accent. Orange is reserved exclusively for signal — threat, severity, active state — and denied to everything else. On a screen watched for hours, colour restraint is the alerting mechanism.
-
Direction & handoff
I set the framing, IA and interaction model, then ran critique as the team built out the lens states, empty states and tooltip layer to pitch fidelity. Outcome — add the result here: won account / led to X.
Restraint as an alerting system
A single accent on a greyscale field means severity reads pre-attentively — before the analyst consciously scans. Decorative colour would have cost the product its most important signal.
Pivot, don't navigate
Threat / Source IP / Server swap the lens in place. Investigation is a train of thought; a page load breaks it. The tab pattern kept context intact through the pivot.
Shape before number
The topology map lets volume register as pattern, not as a value to be compared. The exact count is still available on demand — it just isn't the price of admission.