Dark mode for the attack map is a good call for NOC screens. One idea for a future version: show the network type next to each dot.

Most intrusion attempts come from cloud servers, VPN exits and proxies, so the map shows where the attacking server sits, not where the attacker is. An admin who sees a cluster over Amsterdam or Virginia can easily read it as "attacks from the Netherlands" when it's really "attacks from rented servers". Adding the ASN and a hosting/VPN/residential label to the tooltip, maybe with a filter, would make the map tell that story correctly.

(Disclosure: I work on IPGeolocation.io, which provides that kind of IP classification, so I'm a bit biased about how useful it is.)