Attack Map

Incident > Attack Map is a visual representation of the entire network showing real endpoints, Decoy VMs, and ongoing attacks.

To work with the Attack Map:

1. Go to Incident > Attack Map.
   • To change the display, drag items to another location.
   • Scroll to zoom in or out.
   • Click a node to see its information.
2. At the bottom of the Attack Map, use the timeline indicator to set the start and end time.
3. Click Click to begin filtering to select a different filter type and type values.

   Filter types include Attacker IP, Victim IP, and Decoy IP.

   You can use multiple arguments with different filter types. All filter arguments and time indicator arguments are considered "AND" conditions.

4. To locate the node on the map, use the LOCATE BY IP box.
5. To save a snapshot of the map, click Save view .