Analyze
Every point is one process execution. Techniques cluster; novel behaviour sits apart.
Embedding view
Placed by what the command does.
Scroll to zoom · drag to pan · hover a point, click to inspect
synthetic CrowdStrike ProcessRollup2 + AttackIQ · no production data