> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/intrusion-detection-system/world-map.md). # World Map The world map gives you a live overview of all attacks that are currently taking place on your network. {% hint style="danger" %} **Please note**: For values to be shown here, the following requirements must be met: * *Detection* of network anomalies must be enabled in the [settings of the individual hosts](/docs/manual/english/platform-usage/host-detail-view/settings.md#core-feature) or under **Hosts** → **Policies** via a [corresponding policy](/docs/manual/english/platform-usage/hosts/management/policy-manager/add-policy-manager.md#enginsight-intrusion-detection-system-ids). * *Blocking* of network attacks must be enabled in the [settings of the individual hosts](/docs/manual/english/platform-usage/host-detail-view/settings.md#core-feature) or under **Hosts** → **Policies** via a [corresponding policy](/docs/manual/english/platform-usage/hosts/management/policy-manager/add-policy-manager.md#enginsight-shield-ips). {% endhint %} *** ## Important Notes **Showing Attacks** * The world map view shows all attacks in real time. As long as the map shows that it is searching for active attacks, no attack is currently taking place on the respective network. **Showing Attacks on Internal IP Addresses** * Attacks on hosts with an internal IP address cannot be assigned to a geographic location via IP geolocation. For this reason, attacks on hosts with an internal IP address are by default shown on the world map at the **location of the organization** in which the host was created. * If you entered [location information](/docs/manual/english/platform-usage/host-detail-view/settings.md#location-information) in the **settings of a host**, this information is used to show the geographic location of the host on the world map. *** Navigate to **Hosts** → **Intrusion Detection System** → **World Map** to show detailed information about attacks that are currently taking place on your network as lists and as a rotating globe.

*** ## World Map: Navigation Enable or disable the toggle next to **Pause** to pause or resume real-time detection of network attacks. Enable or disable the toggle next to **Autorotate** to stop or resume rotation of the world map. Click **Full Screen** to show the world map window in full-screen mode. Press **Esc** to exit the full-screen mode. Left-click the globe and hold down the mouse button to rotate the view in any direction. Use your mouse's scroll function to zoom in or out of the globe. *** ## Attacks: Analytics The dashboard shows the following information from left to right and from top to bottom: ### Top Not Blocked Attacking IPs {% columns %} {% column width="50%" %}

{% endcolumn %} {% column width="50%" %} Shows the IP addresses from which the most attacks are currently being carried out and that have not yet been blocked, as well as the respective number of attacks. Click the **Block** icon to block the IP address directly from this view. The [Add Manual Rule](/docs/manual/english/platform-usage/hosts/intrusion-detection-system/network-anomalies.md#adress-anomaly) window opens. {% endcolumn %} {% endcolumns %} *** ### Top Blocked Attacking IPs {% columns %} {% column %}

{% endcolumn %} {% column %} Shows the IP addresses from which the most attacks are currently being carried out and that have already been blocked, as well as the respective number of attacks. {% endcolumn %} {% endcolumns %} *** ### Top Attacked Hosts {% columns %} {% column %}

{% endcolumn %} {% column %} Shows the hosts that are currently being attacked most frequently, as well as the respective number of attacks. Click the name of a host to navigate to the respective [host detail view](/docs/manual/english/platform-usage/host-detail-view.md). {% endcolumn %} {% endcolumns %} *** ### Attacks by Name {% columns %} {% column %}

{% endcolumn %} {% column %} Shows the attack types that occur most frequently, as well as the respective number of attacks. {% endcolumn %} {% endcolumns %} *** ### Top Attacker Countries {% columns %} {% column %}

{% endcolumn %} {% column %} Shows the countries from which the most attacks originate, the names of the organizations from which the most attacks are being carried out, as well as the respective number of attacks. {% endcolumn %} {% endcolumns %} *** ## Attacks: Log The attack log dynamically records all attacks from the last few minutes.

The log provides the following information:

Column	Description
Attacker (Organization)	Shows the IP address and name of the attacking organization.
Host	Shows the name of the host that was attacked. Click the name of a host to navigate to the respective host detail view.
Attack	Shows the attack type.
Detected	Shows the date and exact time, down to the second, at which the attack was detected.
Severity	Shows the severity of the attack or whether it was blocked (Blocked). The following severity levels can be shown: Critical: The attack has a very high criticality. High: The attack has a high criticality. Medium: The attack has a medium criticality. Low: The attack has a low criticality.

***