Even after log filtering, aggregation, prioritization and correlation, Security Information and Event Management users are still dealing with log data explosion and it's difficult for them to see quickly what, where and when security events appear on the network. Although SIEM products are acquiring maturity and provide now many values added, I'm still convinced that existing products on the market still lack in data visualization capability. 

The San Francisco Crimespotting gives us a good insight of what the next generation of SIEM user interface could be. This is an interactive map of crimes in San Francisco (the Oakland map is also available) and an innovative way to visualize data over the time and space. This information is for sure very useful for people that are (or plan) living there but I'm more interested in the data visualization model and I can easily imagine applying it to the Security Event Management world. 

Crimespotting inspires a new approach of Security Event visualization, I can conceive a map of business asset, application, users, servers and network devices completely explorable - with the possibility to pan and zoom, select date ranges in the past, and view specific kind of alert based on a category (or a taxonomy). As with Crimespotting, I can also envisage to share links directly to a particular view of the map, which is important for incident handling or log forensics. 

This tool is using the Adobe Flash technology which is not yet common in enterprise class product but starts to be adopted by some vendors for specific part of the GUI (i.e. dynamic dashboard). Do you think Flash is a good solution to present complex problem? Do you have other example like this?