IP-Based Geographic Distribution

In this scenario, security teams can monitor outbound connections to identify:

  • Unusual connection destinations

  • Data exfiltration patterns

  • Geographic distribution of network traffic

Sample input data. Here is example input data for this scenario:

bytes_transferreddestination_ipevent_simpleNameportsource_hostnamesuccesstimestamp
1024203.0.113.45NetworkConnection443WKSTN-00112025-09-23T10:15:22Z
2048198.51.100.23NetworkConnection80WKSTN-00212025-09-23T10:15:23Z
4096192.0.2.178NetworkConnection443WKSTN-00312025-09-23T10:15:24Z
8192185.220.101.47NetworkConnection8080WKSTN-00412025-09-23T10:15:25Z
51245.142.212.61NetworkConnection22WKSTN-00512025-09-23T10:15:26Z

Query. To create a worldmap, use the following query:

logscale
event_simpleName=NetworkConnection destination_ip=*
| !cidr(destination_ip, subnet=["224.0.0.0/4", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16", "0.0.0.0/32"])
| worldMap(ip=destination_ip, magnitude=count())

Query breakdown:

  1. Filter for events with event_simpleName=NetworkConnection that have a destination_ip field.

  2. Exclude internal and reserved IP addresses using the cidr() function with subnet filters for multicast (224.0.0.0/4), private networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.0/8), link-local (169.254.0.0/16), and unspecified (0.0.0.0/32) addresses.

  3. Use the worldMap() function with the ip parameter set to destination_ip and magnitude set to count() to plot connection destinations on the map with connection frequency.

Visualization: The map displays external connection destinations as markers, with darker colors or larger marker sizes indicating higher connection frequency. Hover over points to see country, connection count, and destination details. Zoom in for regional detail to identify specific geographic patterns.

Screenshot showing a World Map widget titled IP-Based Geographic Distribution displaying external network connection destinations as markers across a world map, with marker sizes indicating connection frequency, and Format World Map panel visible on the right showing Center, Marks, and Projection configuration options

FigureĀ 256.Ā IP-Based Geographic Distribution


Configuration:

  1. From the Search page, type your query in the Query Editor ā†’ click Run

  2. Choose World Map in the Widget Selector

  3. Click the style icon : the side panel shows most settings already configured by default based on the query result.

  4. In Center, adjust the latitude, longitude, and zoom level to focus on your regions of interest for security monitoring.

  5. In Marks, set the magnitude mode to Size to scale marker size based on connection frequency. Configure Min point size and Max point size to make high-frequency destinations visually prominent.

  6. Adjust Projection to Orthographic to obtain the map projection type in FigureĀ 256, ā€œIP-Based Geographic Distributionā€.

  7. Add a custom Title such as External Network Connections by Geographic Location.

You can further customize this widget by setting more properties, see World Map Property Reference.