BGP and ASN context
Relate an address to an observed route and network origin instead of treating every IP as an isolated indicator.
MapAttack · Specialised SIEM
See the Internet behind every alert.
Centralise your alerts. Understand their network origins. Give your security decisions context.
Attack analysis and Internet exposure
Product currently in development
A specialised SIEM built for everyday operations
MapAttack brings together alerts from IDS, WAF and monitored services, then connects them with BGP routing context. Move from an isolated IP address to the prefix, ASN, operator, country, targeted service and evidence behind a decision.
SUPPORTED INPUTS INCLUDE
- Snort and network IDS
- ModSecurity and WAF
- Fail2ban and exposed services
Operational questions
Start with what your team needs to establish
- 01Where do the alerts originate?
- Source addresses, BGP prefixes, ASNs, operators and available geographic origins.
- 02What is being targeted?
- Destinations, exposed services, ports and the detection rules involved.
- 03Is the activity isolated or recurring?
- Grouping by source, attack and source/attack pair, with volumes and distinct targets.
- 04Why was this decision made?
- The observed context, rule, policy, reason and decision record remain available for review.
From sensor to decision
One chain for signals, context and controlled action
Each stage remains inspectable. MapAttack prepares operational outputs; enforcement stays under the control of the team and its equipment.
- 01
Collect and normalise
Bring supported formats together and standardise dates, addresses, ports, rules and classifications.
- 02
Add network context
Connect a source to the most specific prefix in the active BGP snapshot, its ASN and available operator or geographic information.
- 03
Observe and investigate
Move from live activity to search, replay, grouping and the individual events behind each count.
- 04
Prioritise and decide
Review rules and exceptions, record a reason and retain an auditable decision within the relevant tenant scope.
- 05
Prepare action
Provide tenant-specific IPv4/IPv6 text feeds or ASN route exports for equipment configured by the team.
Product focus
Context that follows the investigation
Explainable counts
Open grouped volumes to inspect the rules, sources, targets and events that support the analysis.
Live and historical inquiry
Use monitoring, time filters and replay of up to the last 24 available geolocated hours in the same workflow.
Tenant governance
Organise visibility scopes, roles, decisions, reasons and IP/CIDR exceptions for service-provider operations.
Operational collection
Checkpoint recovery, durable journalling and deduplication provide observable control points for ingestion.
Usable outputs
Prepare IPv4/IPv6 feeds and ASN prefix files while keeping firewall enforcement separate and explicit.
Product interface
From an activity spike to a documented decision
These screens show the current product direction with generated demonstration data. They are not customer records.
Search and investigate
Define a period and network scope, filter by IP/CIDR or ASN, then inspect the events behind the result.
Product interface preview · Illustrative demonstration data · Volumes and timings are not production or performance measurements.
Arbitrate rules
Apply a reasoned decision to selected detection rules and preserve the decision record.
Product interface preview · Illustrative demonstration data · Volumes and timings are not production or performance measurements.
Examine networks and ASNs
Review observed network origins and move from individual addresses to prefix and ASN context.
Product interface preview · Illustrative demonstration data · Volumes and timings are not production or performance measurements.
Separate tenant scopes
Organise analysis and policy around explicit customer or infrastructure perimeters.
Product interface preview · Illustrative demonstration data · Volumes and timings are not production or performance measurements.
Deliver IP feeds
Expose dedicated IPv4 and IPv6 text lists for supported consumers and existing scripts.
Product interface preview · Illustrative demonstration data · Volumes and timings are not production or performance measurements.Designed for operational teams
Three focused working contexts
Security teams
Understand an activity spike against an exposed service, verify the events and hand over an evidence-based investigation.
Organise the evidence behind an investigation.Hosting providers and operators
Find the network behind several sources, examine targeted destinations and prepare an ASN prefix export when required.
Move from addresses to operational network context.MSPs
Work by customer scope with roles, documented decisions, network exceptions and dedicated IP feed keys.
Structure analysis around explicit responsibilities.MapAttack
Discover what your alerts reveal about your Internet exposure.
Tell us which services, detection sources and operational scopes you need to bring together. We will determine whether the current MapAttack development scope fits the intended use.