Dashboard · Detection
Identification
The events list, its filters, and one event in full.
Every visit, and one visit in full. This is the screen that answers "what happened on this visit".
The list#
Each row is a visit: when, the verdict, the score, the visitor, browser, OS, address, country, path.
Filters cover the period, the site, the environment, the verdict, and each individual signal. The filters live in the URL, so a filtered screen is a link you can send a colleague.
Only signals the list can filter on appear in the menu. A signal that records only when it fires has nothing to list when it did not.
One event in full#
Opening a row shows everything that was measured:
Verdict and reasons, every rule that fired, its weight, and the evidence behind it.
Network: address, ASN, carrier, country and city, plus the reputation flags. Each flag is tri-state.
Browser and device: the parsed user agent, screen, time zone, languages, fonts, and each fingerprint surface.
Behaviour, when collected: pointer, clicks, scroll, focus, and a behaviour score. That score is not part of the verdict; it is computed at read time and shown for a reader to judge.
Location: a regional map, when there are coordinates.
AI assessment: a button. Nothing runs until you press it. The answer is stored on that visit and never feeds the score.
The four states of the behaviour block#
| State | Means |
|---|---|
| Never collected | An older SDK, or the collector switched off |
| Unreadable | Something arrived and would not parse |
| Observed empty | Collected and nothing had happened yet, which is normal for an honest visit |
| Collected | There are events |
The first three are three different claims about the visitor, and merging them is how a record starts to lie.