We have all the required data, but not put on a map yet.

You can group connections by country in the meantime to get a feel for where things are going. (You can also group by multiple values for a bit more detail.)

Interesting, is this an NDIS x tcpview type program?

Pretty much. As far as I understood, NDIS was replaced by WFP (Windows Filtering Platform). We built our own driver that uses WFP and as such is on the same level as the Windows firewall itself, meaning we can veto its decisions.