Looking for security documentation and consultancy? Visit ridgelinecyber.com
Sign In

Visual Panel Demo

Styled Output Panels — Demo

These panels replace plain code blocks when showing tool output, query results, and log data. They look like the actual tools the learner will use in production.

Terminal Panel — PowerShell

PowerShell — DESKTOP-NGE-042
PS C:\> Get-MgUserAuthenticationMethod -UserId d.chen@northgateeng.com

Method Phone Registered Microsoft Authenticator — 2025-03-15 (legitimate) Phone (SMS) +44-7XXX-XXX-341 2025-03-15 (legitimate) Phone (SMS) +44-7XXX-XXX-892 2026-04-08 08:04 ★ NOT IN HR DIRECTORY

Terminal Panel — Bash

root@SRV-NGE-RHEL01 — /var/log
root@SRV-NGE-RHEL01:~# grep "Failed password" /var/log/auth.log | tail -5

Apr 8 02:14:33 SRV-NGE-RHEL01 sshd[28441]: Failed password for root from 203.0.113.45 port 44821 Apr 8 02:14:35 SRV-NGE-RHEL01 sshd[28441]: Failed password for root from 203.0.113.45 port 44821 Apr 8 02:14:38 SRV-NGE-RHEL01 sshd[28443]: Accepted password for root from 203.0.113.45 port 44829 Apr 8 02:14:38 SRV-NGE-RHEL01 sshd[28443]: pam_unix(sshd:session): session opened for user root Apr 8 02:15:01 SRV-NGE-RHEL01 sshd[28445]: pam_unix(sshd:session): session opened for user root(uid=0)

Query Output — KQL (Sentinel-style results)

▶ KQL Query Results
SigninLogs | where UserPrincipalName == "d.chen@northgateeng.com" | where TimeGenerated > ago(24h) | project TimeGenerated, IPAddress, AppDisplayName, ResultType, RiskLevelDuringSignIn, DeviceDetail
TimeGeneratedIPAddressAppDisplayNameResultTypeRiskLevelDeviceDetail
2026-04-08 07:45:12198.51.100.1Microsoft Teams0noneEdge/Windows
2026-04-08 07:52:08198.51.100.1Outlook0noneEdge/Windows
2026-04-08 07:58:33198.51.100.1SharePoint Online0noneEdge/Windows
2026-04-08 08:02:14203.0.113.45Microsoft Office 3650highChrome/Linux ★
2026-04-08 08:15:41203.0.113.45Microsoft Office 3650highChrome/Linux ★
2026-04-08 08:32:09203.0.113.45Microsoft Graph0highChrome/Linux ★
2026-04-08 09:15:22203.0.113.45Exchange Online0highChrome/Linux ★
7 rows returned — ★ attacker sessions from 203.0.113.45 (Bucharest)

Log Viewer — auth.log

auth.log SRV-NGE-RHEL01 — last 24 hours
Apr 8 02:14:31 sshd[28441]: Connection from 203.0.113.45 port 44821 on 10.1.50.10 port 22 Apr 8 02:14:33 sshd[28441]: Failed password for root from 203.0.113.45 port 44821 ssh2 Apr 8 02:14:35 sshd[28441]: Failed password for root from 203.0.113.45 port 44821 ssh2 Apr 8 02:14:38 sshd[28443]: Accepted password for root from 203.0.113.45 port 44829 ssh2 Apr 8 02:14:38 sshd[28443]: pam_unix(sshd:session): session opened for user root(uid=0) Apr 8 02:15:01 CRON[28450]: pam_unix(cron:session): session opened for user root(uid=0) Apr 8 02:15:44 sshd[28443]: Received disconnect from 203.0.113.45 port 44829: disconnected by user

Inline SVG — Process Flow (small, inline, breaks up text)

This is the kind of small inline diagram that goes between paragraphs to illustrate a specific point — not the large module-header SVG.

AiTM PhishToken TheftMFA PersistBEC

CHAIN-HARVEST attack progression — each stage is detectable with the right automation tier.

The paragraph after the diagram continues the explanation, using the visual as an anchor point the reader can reference.

How These Work Together in Content

In a real subsection, the pattern would be:

  1. Prose paragraph explaining the concept (2-3 paragraphs)
  2. Visual element — terminal panel showing the command, or query output showing the results, or inline SVG showing the flow
  3. Prose paragraph interpreting what the visual shows
  4. Another visual element — a different type
  5. Continue the narrative

This creates a reading rhythm where the learner never reads more than 3 paragraphs without seeing something visual.