Common security tools generate a lot of data suitable for further analysis. However, the raw form of the data is often too complex and useful information gets lost in a large volume of records. In this paper, we propose a system for visualization of the data generated by a DNS firewall and outline a process of visually emphasizing information important to incident handlers. Our prototype suggests that such visualization is possible, keeping the balance between the amount of displayed information and the level of detail.