Exploring the Design Space for Cyber Alerts in Context

During knowledge elicitations with cyber analysts, we uncovered a need for tools that help analysts understand threat alerts in a context of baseline “normal” behaviors. We used an iterative design process to create a prototype alert management system with which we can explore the critical design space for effective baseline visualizations. We report herein on the design elements of this user interface, and present associated expert feedback from a design evaluation in the associated poster. We summarize our initial insights into the design of effective baseline visualizations that could be integrated into a larger visualization-support cyber alert management workflow desired by cyber analysts.