A dashboard for watching the network defend itself

The lab's router has been quietly generating intrusion-detection and
intrusion-prevention alerts for a while, but they only lived in raw log
form — useful in theory, unreadable in the moment an incident actually
happens. This one was about closing that gap.

The result is a lightweight security dashboard: a dark-themed UI with a map
of where alerts are originating from, and a live feed of events as they
come in. Nothing exotic on the visualization side — the goal was legibility
under pressure, not a data-viz showcase.

The part I actually wanted most, though, was a built-in knowledge base. When
an alert fires, the question is never just "what is this," it's "what is
this, right now, without me having to go search the vendor's docs while
something might be actively happening." So the dashboard ships with offline
explanations baked in for the alert types I actually see.

It's a backend API plus a frontend, both purpose-built rather than bolted
onto an existing tool. Simple scope, but it turns "check the logs" into
"glance at the dashboard," which is the whole win.