A Sankey chart scales each link by the volume it carries, so an unusual flow between hosts stands out instead of hiding in a log table. Here’s how security teams use them for network traffic, authentication paths, attack paths, and log routing. https://graylog.org/post/how-security-teams-can-use-sankey-charts/