Telemetry Graph POC
Starting from a single SHA-256 dropper hash observed across many customer tenants worldwide, this proof of concept:
- Generates synthetic telemetry - realistic data modeling a global email-based malware campaign across 25+ countries, multiple tenants, and thousands of hosts
- Builds an entity graph - transforms raw telemetry into interconnected nodes (files, hosts, emails, domains, IPs, users, campaigns) and edges (relationships between them)
- Visualizes the graph in 3D - a browser-based interactive graph where analysts can rotate, zoom, filter, search, and inspect entities to understand how the malware spreads
Try the interactive demo to explore the graph in your browser – rotate, zoom, filter by node type or country, and click nodes to inspect their properties.
Architecture
generator/ Synthetic telemetry generator (Python, seeded for reproducibility)
pipeline/ Graph construction pipeline (Python, transforms telemetry into nodes + edges)
api/ Backend API (Python / FastAPI, serves graph data)
frontend/ Web application (React / TypeScript, 3D force-directed graph)
Entity Types
| Type | Examples |
|---|---|
| File / Malware | SHA-256 hashes, file names, paths, dropped files, process trees |
| Host / Device | Hostname, OS, device type, country, tenant, security posture |
| Sender, subject, attachment, delivery time, auth results | |
| Network / Infra | URLs, domains, IPs, ASN, ports, SSL certs |
| Execution | Process events, persistence, C2 connections, follow-on payloads |
| Campaign | Cluster ID, region variant, lure family, time window |
Analyst Questions This Answers
- Which countries saw this dropper most often?
- What file paths were most commonly used?
- Which domains and IPs were reused across tenants?
- Were there regional campaign variants?
- What follow-on payloads were associated with this hash?