█████╗ ██╗     ██╗      ██████╗ ██████╗  █████╗ ████████╗██╗ ██████╗ ███╗   ██╗
██╔══██╗██║     ██║     ██╔════╝ ██╔══██╗██╔══██╗╚══██╔══╝██║██╔═══██╗████╗  ██║
███████║██║     ██║     ██║  ███╗██████╔╝███████║   ██║   ██║██║   ██║██╔██╗ ██║
██╔══██║██║     ██║     ██║   ██║██╔══██╗██╔══██║   ██║   ██║██║   ██║██║╚██╗██║
██║  ██║███████╗███████╗╚██████╔╝██║  ██║██║  ██║   ██║   ██║╚██████╔╝██║ ╚████║
╚═╝  ╚═╝╚══════╝╚══════╝ ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝   ╚═╝   ╚═╝ ╚═════╝ ╚═╝  ╚═══╝

AttackVisor — Operator-grade real-time situational awareness dashboard. Eleven live feeds across cyber, world, and finance — fused into a single 3D-globe SOC view with WebSocket delivery and configurable alerting.

Overview

AttackVisor is a real-time security operations dashboard that aggregates 11 high-signal intelligence feeds into a unified 3D globe visualization. Built for security teams who need to see the full picture — from mass scanning activity and BGP hijacks to CVE exploit predictions and ransomware victim tracking.

Key Features

• 11 Live Data Feeds: DShield, Cloudflare Radar, NVD/EPSS, CISA KEV, ransomware.live, Coinbase WS, USGS, NOAA SWPC, Wikipedia ITN, GDELT, ISS
• 3D MapLibre Globe: Country outages, BGP hijack arcs, mass-scan ASN dots, ransomware markers, earthquake epicenters, ISS orbital track
• WebSocket Fan-out: Single Go binary runs all collectors as errgroup goroutines, events flow through an in-process bus to all connected clients
• CVE Intelligence: EPSS-weighted prioritization with CISA KEV diff alerts
• Configurable Alerting: Toast/banner/chime/Telegram/Discord with AES-256 encrypted webhook secrets at rest
• Time-Series Storage: BRIN-indexed PostgreSQL for append-mostly event streams
• JWT Auth: Auto-rotating Ed25519 (ES256) keys with JWKS endpoint

Quick Start

# Clone and enter
git clone https://github.com/coot/AttackVisor.git
cd AttackVisor

# Configure environment (optional - works without API keys)
cp .env.example .env
# Edit .env to add API keys for enhanced data

# Start development stack
just dev-up

Visit http://localhost:8432 — the globe initializes and panels populate as collectors complete their first poll cycles.

Note: This project uses just as a command runner. Type just to see all available commands. Install: curl -sSf https://just.systems/install.sh | bash -s -- --to ~/.local/bin

Architecture

┌─────────────────────────────────────────────────────────────────┐
│  External Feeds (HTTP/WS, varying cadences)                     │
│  DShield · CF Radar · NVD · EPSS · KEV · ransomware.live        │
│  · Coinbase · USGS · NOAA SWPC · Wikipedia · GDELT · ISS        │
└──────────────────────────┬──────────────────────────────────────┘
                           │
                    ┌──────▼──────┐
                    │  Collector  │  ← One errgroup goroutine per feed
                    │  (×11)      │
                    └──────┬──────┘
                           │ Emit(events.Event)
                           ▼
              ┌────────────────────────┐
              │      Event Bus         │  ← Buffered channel (512)
              │  (internal/bus/bus.go) │
              └───────────┬────────────┘
                          │
          ┌───────────────┼───────────────┐
          ▼               ▼               ▼
   ┌────────────┐  ┌────────────┐  ┌────────────┐
   │   Redis    │  │  ws.Hub    │  │  Alerts    │
   │  Snapshot  │  │  (WebSocket│  │  Engine    │
   │  Store     │  │   Fan-out) │  │  (CEL)     │
   └────────────┘  └────────────┘  └────────────┘
          │               │               │
          ▼               ▼               ▼
   GET /v1/snapshot   /v1/ws          Telegram/
   (REST hydrate)     (WS stream)     Discord/Slack

Why Single Binary?

For a single-operator, single-screen dashboard, a broker (Kafka/NATS) is overkill. The in-process channel bus handles ~100 events/sec peak with zero operational overhead. If you need horizontal scale, swap bus.Bus for NATS JetStream — the collector and frontend interfaces stay the same.

Data Sources

Panel	Source	Cadence	Auth
Mass-scan firehose	DShield (SANS ISC)	1h	none
Internet outages + BGP hijacks	Cloudflare Radar	5m	CF_RADAR_TOKEN
CVE velocity + EPSS	NVD CVE 2.0 + FIRST EPSS	2h	NVD_API_KEY (optional)
CISA KEV (in-the-wild)	CISA KEV catalog	1h	none
Ransomware victims	ransomware.live	15m	none
BTC + ETH live ticks	Coinbase Advanced Trade WS	persistent	none
Earthquakes (M2.5+)	USGS GeoJSON	1m	none
Space weather (Kp/Bz/X-flux)	NOAA SWPC	1m / 3h	none
World events	Wikipedia ITN + GDELT v2	5m / 15m	none
ISS position + passes	wheretheiss.at + CelesTrak	10s / 24h	none
IP enrichment (BGP)	AbuseIPDB	on-demand	ABUSEIPDB_API_KEY (optional)

Stack

Layer	Technology
Backend	Go 1.25, chi v5, coder/websocket, pgx, goose migrations
Frontend	React 19, TypeScript, Vite, TanStack Query v5, Zustand, MapLibre GL, D3
Database	PostgreSQL 17 (BRIN indexes), Redis 7
Infrastructure	Docker Compose, nginx, Cloudflare Tunnel (prod), multi-stage builds

Configuration

Copy .env.example to .env and fill in any API keys you have:

cp .env.example .env

Variable	Required	Description
CF_RADAR_TOKEN	No	Cloudflare Radar API token for outage/BGP feeds
NVD_API_KEY	No	NVD API key (raises rate limit 10x)
ABUSEIPDB_API_KEY	No	AbuseIPDB for IP enrichment
NOTIFICATION_ENCRYPTION_KEY	For alerts	AES-256 key (generate: openssl rand -base64 32)
CLOUDFLARE_TUNNEL_TOKEN	Prod only	Cloudflare Tunnel token
ADMIN_EMAIL	No	Auto-promote this email to admin on first login

Development Commands

just              # List all commands
just dev-up       # Start dev stack (postgres, redis, backend, frontend)
just dev-logs     # Follow dev logs
just test         # Run Go tests with race detector
just lint         # Run golangci-lint
just build        # Build production binary
just migrate      # Run database migrations
just info         # Show project info

Production Deployment

# Configure production environment
cp .env.example.prod .env.prod
# Edit .env.prod with strong passwords and API keys

# Deploy with Cloudflare Tunnel
just prod-redeploy
just migrate

Project Structure

AttackVisor/
├── backend/                    # Go 1.25 backend
│   ├── cmd/api/main.go         # Application entry point
│   ├── internal/
│   │   ├── admin/              # Admin endpoints (DB/Redis stats)
│   │   ├── alerts/             # CEL-based alert engine
│   │   ├── auth/               # JWT (ES256) + Argon2id auth
│   │   ├── bus/                # In-process event bus
│   │   ├── collectors/         # 11 feed collectors
│   │   ├── config/             # Koanf-based configuration
│   │   ├── core/               # Database, Redis, telemetry
│   │   ├── enrich/             # AbuseIPDB, GreyNoise enrichment
│   │   ├── events/             # Event types and topics
│   │   ├── intel/              # Historical query endpoints
│   │   ├── middleware/         # Auth, rate limit, CORS, logging
│   │   ├── notifications/      # Encrypted webhook delivery
│   │   ├── redisring/          # Redis ring buffer for SWPC
│   │   ├── server/             # HTTP server setup
│   │   ├── snapshot/           # Redis snapshot store
│   │   ├── user/               # User management
│   │   └── ws/                 # WebSocket hub
│   ├── migrations/             # Goose SQL migrations
│   ├── config.yaml             # Default configuration
│   └── go.mod / go.sum
├── frontend/                   # React 19 + TypeScript + Vite
│   ├── src/
│   │   ├── api/                # WS driver, snapshot client
│   │   ├── components/         # Reusable UI components
│   │   ├── core/               # App routing, hooks
│   │   ├── lib/                # Utilities (audio, SGP4, etc.)
│   │   ├── pages/              # Dashboard, Globe, Settings
│   │   ├── stores/             # Zustand stores per topic
│   │   └── types/              # TypeScript types
│   ├── public/                 # Static assets (geo JSON)
│   └── package.json / tsconfig.json
├── conf/
│   ├── docker/                 # Multi-stage Dockerfiles
│   └── nginx/                  # Nginx configs (dev/prod)
├── learn/                      # Learning modules (00-04)
├── compose.yml                 # Production Docker Compose
├── dev.compose.yml             # Development Docker Compose
├── cloudflared.compose.yml     # Cloudflare Tunnel
├── Justfile                    # Command runner recipes
├── .env.example / .env.example.dev / .env.example.prod
└── LICENSE                     # AGPL 3.0

Learning Modules

Module	Topic	Duration
00 - Overview	Prerequisites and quick start	10 min
01 - Concepts	Threat intel theory, EPSS, KEV, BGP hijacks	20 min
02 - Architecture	Single-binary pipeline, event bus, WebSocket fan-out	30 min
03 - Implementation	Code walkthrough across all components	45 min
04 - Challenges	Extension ideas and hardening	15 min

Testing

# Backend tests (with race detector)
cd backend && go test -race ./...

# Frontend tests
cd frontend && pnpm test

License

AGPL 3.0 — see LICENSE for details.

This project is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

Contributing

Issues and PRs welcome. Please read the Architecture and Implementation docs before contributing significant changes.

Attribution

Originally based on monitor-the-situation-dashboard by AngelaMos (CarterPerez-dev), rebranded and maintained as AttackVisor.

---

Built for defenders who need to see everything, now.