Multi-Cloud Threat Correlation Graph (2D)

Isolated cloud tenants each generate their own quiet stream of control-plane telemetry — but a coordinated attacker hitting several tenants with the same technique leaves a signature that only becomes visible once a detection engine correlates across the isolation boundary. This simulation renders tenants as bounded regions arranged in a ring, streams benign noise and occasional coordinated-campaign events into them, and draws live correlation links whenever enough tenants share a signature inside the current time window. Drag to pan the ring and scroll to zoom; tune the tenant count, signature alphabet, campaign rate, correlation window and detection threshold to see the same trade-off real cloud SOC teams face — a looser rule catches real campaigns faster but also flags pure statistical coincidence as a false positive — and watch the live correlation-score sparkline and the corrected birthday-paradox probability track that trade-off in real time.