Visualization Trends in Security Products

It is fairly interesting to see how security prodcuts are maturing. In the last couple of years I have seen quite some progress in products using visualization. Let's look back a few years. Network-based IDSs, for example, logged events in a log file; text [and some still do!]. Over time, reporting was added; a way to summarize historical data. Drop a pie-chart on the report and you have something that you can hand to your collegues. Shortly after that dashboards came about. Finally we had something to show to our managers, not just our peers. Most products have a dashboard today. Not all of them are very useful, but at least they have one ;) The next evolutionary step was to link the dashboards with the data itself. Drill-down was added.

And this is where we are today. Most products are at this stage. Only a few products took this a steps further. They added for example dashboards that link to other dashboards, which show more specific information. Some products even offer customizable dashboards (not all do!). You have the capabilities to either build your own or change predefined ones.

There are only a handful of products in the security space which take visualization a bit more serious. Thos products offer visual interfaces which support dynamic queries [basically the capability to let you change/interact with the graphs on the fly.]. This is clearly how it should be. It gives the user the tools he needs to interact with the data.

I am very convinced that dynamic, interactive, visual interfaces are going to be added to more and more products. They are incredibly powerful and invalueable for data anlysis and representation!