Live investigation cases

Every incident here is built live from real attacker IPs in the SANS DShield feed, clustered by source country and threat kind. Each one bundles its linked alerts, a real-time timeline, and AI-generated findings + recommendations. No seed data — refresh and the cluster set rebuilds from whatever DShield observed in the last 24h.