\section{Comparison with proprietaries tools}
Assessing the direct or indirect benefits experienced by targeted users is crucial for evaluating the impact of scientific research. Recent studies focusing on addressing the ``interactive visualization gap" have also contributed to the formulation of diverse design recommendations aimed at better integrating interactive visualization techniques into data science workflows \cite{gap_paper}. In the domain of cybersecurity visualization, the adoption of user-centered design methodologies has played a significant role in the creation of visualization tools that effectively cater to the needs of target users. These tools have proven valuable for security experts and cyber operators, aiding them in addressing analytic inquiries arising from real-world scenarios they encounter. Evaluation studies have identified prevailing trends in evaluation methodologies, providing insights into how the research community measures the efficacy of proposed cybersecurity visualization techniques, systems, models, and tools. While these works are instrumental in highlighting emerging trends and guiding future directions for the development of effective tools, they fall short in providing an estimation of how research results and techniques are applied in real-world settings.

The objective of this section is to examine various options provided by enterprise-grade tools within the realm of security visualization. This analysis serves two main purposes: firstly, to offer an overview of the visualization methodologies employed, and secondly, to facilitate a comparative analysis with the research outcomes presented earlier. The selection of these tools was carried out through two distinct processes. Firstly, a comprehensive search was conducted both online and by referencing the relevant sources identified during the literature review phase of this research. Secondly, a meeting was held with the cybersecurity department at Politecnico di Torino. This dual approach to selection allowed for an extensive exploration of the available options on the internet, providing a comprehensive overview. Additionally, insights were gained into the specific tool choices made within the university context, enabling valuable feedback on the selected tools and facilitating considerations regarding their open-source counterparts.

The two tools selected in the first selection process are SolarWinds Security Event Manager \cite{solarwinds_site} and IBM QRadar \cite{qradar_site}, which are two powerful security intelligence and analytics platforms used by organizations to enhance their cybersecurity capabilities.

\begin{figure}[h]
    \centering
    \includegraphics[angle=90, width=\textwidth, height=\NewHeight]{Figures/chapter4/ProprietariesTools/solarwinds1.png}
    \caption{SolarWinds Security Event Manager dashboard first part}
    \label{fig:solarwinds1}
\end{figure}
\begin{figure}[h]
    \centering
    \includegraphics[angle=90, width=\textwidth, height=\NewHeight]{Figures/chapter4/ProprietariesTools/solarwinds2.png}
    \caption{SolarWinds Security Event Manager dashboard second part}
    \label{fig:solarwinds2}
\end{figure}
\FloatBarrier
SolarWinds Security Event Manager is designed to centralize log management and provide real-time monitoring and analysis of security events. It collects logs and event data from various sources, applies correlation algorithms to identify patterns and anomalies, and generates alerts for proactive threat detection. The tool also offers log analysis capabilities and reporting features for investigating security incidents and meeting compliance requirements.

\begin{figure}[h]
    \centering
    \includegraphics[angle=90, width=\textwidth, height=\NewHeight]{Figures/chapter4/ProprietariesTools/solarwinds_history.png}
    \caption{SolarWinds Security Event Manager dashboard Logs history}
    \label{fig:solarwinds_history}
\end{figure}
\FloatBarrier
IBM QRadar, on the other hand, is a comprehensive security information and event management (SIEM) platform. It collects and analyzes logs and events from diverse sources, utilizing advanced analytics and machine learning algorithms to detect and prioritize threats. QRadar integrates with threat intelligence feeds to enhance its detection capabilities and includes user and entity behavior analytics features to identify anomalous user behavior. The platform also supports incident response and workflow orchestration, providing a centralized dashboard for managing security incidents and ensuring compliance with regulatory requirements.

\begin{figure}[h]
    \centering
    \includegraphics[scale=.3]{Figures/chapter4/ProprietariesTools/qradar1.png}
    \caption{IBM QRadar dashboard first part}
    \label{fig:qradar1}
\end{figure}
\begin{figure}[h]
    \centering
    \includegraphics[scale=.3]{Figures/chapter4/ProprietariesTools/qradar2.png}
    \caption{IBM QRadar dashboard second part}
    \label{fig:qradar2}
\end{figure}
\FloatBarrier

Both tools were examined by leveraging the availability of interactive online demo versions provided by the respective companies. This approach was chosen due to the inherent limitations associated with analyzing enterprise-scale infrastructures, as the requisite setup and data transmission processes would have entailed significant time and expertise beyond the scope of this thesis endeavor. The extracted images (figures \ref{fig:solarwinds1}, \ref{fig:solarwinds2}, \ref{fig:qradar1}, \ref{fig:qradar2}) reveal the presence of several common elements observed in previous analyses, notably the utilization of a generic dashboard structure that offers a comprehensive overview of essential information. The visualizations employed in commercial products tend to adhere to conventional and widely-adopted methodologies, featuring classic representations such as histograms, pie charts, and line charts. In relation to more intricate visualization types or unconventional data representations, the findings indicate a scarcity of such instances. This can be ascribed, partially, to the tools' need to cater to a broad range of organizational contexts, thereby prioritizing more universally applicable visualizations. Furthermore, specific analysis requirements may not necessitate the incorporation of certain visualization techniques within the examined tools. Notably, there are discernible variations in visualizations for instance, SolarWinds offers a supportive Timeline for analyzing textual logs (figure \ref{fig:solarwinds_history}), while QRadar presents its version of the attack graph to facilitate threat investigation phases (figure \ref{fig:qradar_ag}).

\begin{figure}[h]
    \centering
    \includegraphics[scale=.3]{Figures/chapter4/ProprietariesTools/qradar_ag.png}
    \caption{IBM QRadar attack graph}
    \label{fig:qradar_ag}
\end{figure}
\FloatBarrier
Upon examining the security analysis approaches employed by the Politecnico di Torino, this analysis focuses on the presentation of two solutions, one from the industry sector called Cycognito and the other from the open-source domain known as ntop, both incorporating visual elements. Cycognito \cite{cycognito_site} focuses on proactive attack surface management, offering continuous visibility into an organization's attack surface. It actively maps and profiles external assets, identifying potential security vulnerabilities and misconfigurations. With automated scanning and manual testing techniques, Cycognito assesses an organization's security posture, performs attack simulations, and validates the effectiveness of security controls.

\begin{figure}[h]
    \centering
    \includegraphics[scale=.33]{Figures/chapter4/ProprietariesTools/cycognito1.png}
    \caption{Cycognito dashboard overview part1}
    \label{fig:cycognito1}
\end{figure}
\begin{figure}[h!]
    \centering
    \includegraphics[scale=.33]{Figures/chapter4/ProprietariesTools/cycognito2.png}
    \caption{Cycognito dashboard overview part2}
    \label{fig:cycognito2}
\end{figure}
\FloatBarrier

On the other hand, ntop (which is available as both an open-source version and a commercial version) \cite{ntop_site} specializes in network traffic monitoring and analysis. It captures and analyzes network traffic in real-time, providing administrators with visibility into network usage and performance. Ntop generates reports and statistics on bandwidth usage, top talkers, and network protocols, allowing organizations to understand traffic patterns, identify potential bottlenecks, and make informed decisions.

\begin{figure}[h]
    \centering
    \includegraphics[scale=.37]{Figures/chapter4/ProprietariesTools/ntop_overview.png}
    \caption{Ntop dashboard overview}
    \label{fig:ntop1}
\end{figure}
\begin{figure}[h]
    \centering
    \includegraphics[scale=.37]{Figures/chapter4/ProprietariesTools/ntop_traffic.png}
    \caption{Ntop traffic view}
    \label{fig:ntop2}
\end{figure}
\FloatBarrier
Similarly, no distinctive visualization methodologies are observed in these cases, with the mentioned types of charts being prevalent once again. However, it is worth noting that ntop offers extensive customization options, enabling users to create a tailored dashboard for analyzing their network infrastructure. In addition to providing an overview of the adopted solutions, the insights gathered from discussions with industry experts have shed light on their perspectives regarding the selected tools. One of the primary factors that influenced the preference for commercially-provided applications over open-source alternatives is the availability of comprehensive support services. These services encompass not only assistance with configuration processes but also prompt resolution of any encountered issues throughout the contractual period. The analysts emphasized the importance of such support services, as they enable organizations to leverage the tools more effectively within their existing infrastructures. Moreover, the experts highlighted that the configuration process for ntop, an open-source tool, was notably more complex compared to its commercial counterparts. The availability of dedicated support services provides added convenience and a different temporal dimension, both of which hold significant value in the realm of security data monitoring. Another significant finding discussed during the meeting, which supports the research findings \cite{gap_paper}, pertains to the dissemination of the extracted analysis information. Irrespective of the intricacy of the employed visualizations during the analysis phase, it was observed that visual elements are not extensively utilized in the subsequent reporting phase. This can be attributed to the perception that visual representations often require additional effort and training from the intended recipients of the reports, rendering them less helpful in practice. Consequently, a more conventional reporting approach, such as textual summaries or tabular representations, is commonly favored to effectively communicate the pertinent findings and insights derived from the analyses. 

Another noteworthy aspect of interest in the capabilities of enterprise tools is the increasing trend towards offering cloud-based services that eliminate the need for local resource allocation. The ability to avoid resource utilization within the monitored infrastructure is undoubtedly advantageous in terms of performance. However, it is essential to consider that these cloud solutions, despite their significant benefits, are accompanied by variable costs depending on the scale of the infrastructure to be covered. Pricing structures typically range from a few thousand euros to several tens of thousands, depending on the specific requirements and scope of the deployment.