Where each attack was launched from, grouped by city. Circle area scales with attempts; a ring marks a source still active at export. Locations come from Microsoft's IP geolocation, spot-checked against a second source.
Sources. Sentinel queries over SecurityEvent (Event 4625) and Cowrie_CL login events, exported Oct 5, 2026. The analyst's own IP is excluded.
Location. Locations come from KQL's built-in geo_info_from_ip_address(), spot-checked against ipinfo.io. The lab's original GeoIP watchlist had put 4 of the top 6 attackers in the wrong country. A location shows where an attack was launched from, not who ran it.
Timing. All times are US Eastern (EDT, UTC−4). "Active" means seen in the 30 minutes before export. Span is first to last attempt, gaps included.