Drill: Dense table: build a 12-column data table (monetary values, IDs, timestamps) at 13px text, 10px cell padding, no gridlines, right-aligned numbers. Target: Tufte data-ink ratio.
Interpretation: Built as an organization's IDS event stream — a SOC analyst's live alert console. 12 columns spanning time, event-ID, severity, source/dest IP, port, proto, rule+signature, action, packets, bytes, sensor. Dark near-black canvas with Linear/Sentry-lineage luminance stepping; single indigo accent for sort+selection only; 9 semantic severity/action colors exempt from the single-hue rule because the hue IS the triage data. 18 visible rows, 13px body, 10px cell padding, hairline dividers only — the pure density discipline re-tested on a fresh domain.
| Time ▾ | Event ID | Severity | Source IP | Dest IP | Port | Proto | Rule / Signature | Action | Packets | Bytes | Sensor | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 14:32:07.412 | EVT-9f2a1b | Critical | 185.220.101.34 | 10.4.22.181 | 22 | TCP | SSH brute-force · 41 failed auth in 8s [ET:2014237] | Blocked | 1,284 | 847.2K | edge-fw-03 | |
| 14:32:03.881 | EVT-3c8d90 | Critical | 45.137.21.9 | 172.16.8.4 | 443 | TCP | SQLi attempt · /api/v2/login UNION SELECT [ET:2009438] | Blocked | 612 | 403.8K | waf-01 | |
| 14:31:58.204 | EVT-7b1e44 | High | 91.134.248.12 | 10.4.22.97 | 3389 | TCP | RDP scanner · 14 hosts probed in 3s [ET:2008541] | Dropped | 428 | 214.1K | edge-fw-01 | |
| 14:31:51.660 | EVT-1a9f0c | Critical | 194.165.16.77 | 10.9.1.5 | 8080 | TCP | Log4Shell exploit · ${jndi:ldap://…} [ET:2034649] | Blocked | 89 | 58.3K | waf-02 | |
| 14:31:44.019 | EVT-5d2e7a | High | 203.0.113.55 | 172.16.8.12 | 443 | TCP | XSS payload · <script> in search param [ET:2010936] | Flagged | 1,041 | 692.7K | waf-01 | |
| 14:31:37.592 | EVT-8c4f12 | High | 198.51.100.22 | 10.4.22.181 | 22 | TCP | SSH brute-force · 23 failed auth in 6s [ET:2014237] | Blocked | 734 | 498.2K | edge-fw-03 | |
| 14:31:30.118 | EVT-2b7a55 | Medium | 45.137.21.9 | 172.16.8.4 | 443 | TCP | Path traversal · ../../etc/passwd [ET:2011103] | Blocked | 147 | 96.4K | waf-01 | |
| 14:31:22.807 | EVT-6e3d88 | Medium | 10.4.22.97 | 169.254.169.254 | 80 | TCP | IMDSv1 access · metadata endpoint probe [ET:2046211] | Flagged | 12 | 7.9K | ids-internal | |
| 14:31:15.334 | EVT-0f9c21 | High | 185.220.101.34 | 10.4.22.181 | 22 | TCP | SSH brute-force · 37 failed auth in 7s [ET:2014237] | Blocked | 1,108 | 731.5K | edge-fw-03 | |
| 14:31:08.501 | EVT-4a8b33 | Medium | 91.134.248.12 | 172.16.8.7 | 3306 | TCP | MySQL cred-stuffing · root/admin/test probes [ET:2009441] | Dropped | 284 | 161.0K | edge-fw-01 | |
| 14:31:01.926 | EVT-9d1f07 | Low | 203.0.113.55 | 10.9.1.8 | 443 | TCP | Rate-limit · 412 req/min from single IP [ET:2400001] | Flagged | 4,128 | 2.7M | edge-fw-02 | |
| 14:30:54.388 | EVT-3e5b19 | Medium | 194.165.16.77 | 10.9.1.5 | 8080 | TCP | Command injection · ;cat /etc/shadow [ET:2011112] | Blocked | 64 | 42.1K | waf-02 | |
| 14:30:47.102 | EVT-7c2a44 | Low | 10.2.4.18 | 172.16.8.4 | 443 | TCP | Anomalous UA · empty User-Agent from internal [ET:2103422] | Flagged | 28 | 18.6K | ids-internal | |
| 14:30:39.655 | EVT-1f8d60 | High | 198.51.100.22 | 10.4.22.181 | 22 | TCP | SSH brute-force · 31 failed auth in 6s [ET:2014237] | Blocked | 982 | 641.9K | edge-fw-03 | |
| 14:30:32.210 | EVT-5a9c18 | Low | 45.137.21.9 | 172.16.8.4 | 443 | TCP | Repeated 404 · /wp-admin scan pattern [ET:2010928] | Allowed | 56 | 37.2K | waf-01 | |
| 14:30:24.877 | EVT-8b3e09 | Info | 10.2.4.18 | 8.8.8.8 | 53 | UDP | DNS tunneling heuristic · high-entropy query [ET:2300044] | Allowed | 3 | 2.0K | ids-internal | |
| 14:30:17.443 | EVT-2d6f71 | Low | 91.134.248.12 | 172.16.8.7 | 6379 | TCP | Redis open-port probe · unauth PING [ET:2018102] | Dropped | 11 | 7.3K | edge-fw-01 | |
| 14:30:09.991 | EVT-0e4a82 | Info | 203.0.113.55 | 10.9.1.8 | 443 | TCP | TLS cert mismatch · SAN does not include host [ET:2510033] | Allowed | 4 | 2.7K | ids-internal |
All numerics use font-feature-settings:'tnum' 1,'zero' 1 + white-space:pre + letter-spacing:-0.02em. Port/packets/bytes right-align on a locked mono grid. Signed deltas would use U+2212 (−), not ASCII hyphen.
Indigo #6366f1 appears ONLY on: active sort caret, selected-row tint + inset 2px left rail + accent event-ID. Severity dots and action labels are semantic (exempt — hue IS the data).
Row separators are rgba(255,255,255,0.04) — weightless. Zero vertical gridlines. Column identity comes from header labels + alignment, not borders. Depth = luminance step #0a0b0e → #111219, flat not glass.
table-layout:fixed with an explicit colgroup. Fixed cols sum < width; the Rule column is the flex slot (width:auto) absorbing slack — the longest variable content, never starved.
Body 13px, headers 10.5px uppercase tracked 0.08em. Cell padding 10px — the edge of comfortable density (08-05 lesson: 8px feels cramped, 12px feels marketing).
At ≤720px the table keeps full layout (min-width:980px) inside a masked scroll container. Chrome (chips, pager) bumps to 36px dense-secondary floor. Search hidden — touch-first.
// design-gym drill · dense table v3 · security event log · 13px / 10px / no gridlines · tnum+zero+pre · single-accent + semantic-severity contract