API Overview

The API Overview provides a summary of the riskiness of API calls and a breakdown of observed risky signals. The summary covers all products and all sites.

The data in this dashboard can be filtered by:

Timeframe
API Checkpoint Name
Funnel
Product
API Call Origin

API Overview Tiles

Name	Description
High Risk API Calls	Displays the number of API calls designated as High Risk.
Medium Risk API Calls	Displays the number of API calls designated as Medium Risk.
Low Risk API Calls	Displays the number of API calls designated as Low Risk.
Total API Calls	Displays the total number of API calls. The total number of calls may exceed the sum of the low, medium, and high risk tiles because it includes calls where risk level could not be determined.
API Call Risk Overview	Displays the API call volume by the calls' designated risk level.
Risky Signals	Displays the volume of the detected high risk signals that caused High Risk API calls to receive that designation.

Account Opening

The Account Opening page contains two dashboards: AO Overview and Segment Analysis.

The AO Overview tab provides a summary of the high risk Account Opening interactions, including information on the reason(s) for the high risk designation, and the involved devices.

The data in this dashboard can be filtered by:

Timeframe
API Checkpoint Name
Funnel
Product
API Call Origin

The Segment Analysis tab provides details on the paths taken by users designated as high or low risk, allowing for comparison between them.

The data in this dashboard can be filtered by:

Timeframe
API Checkpoint Name
Funnel
Product
API Call Origin

AO Overview Tiles

Name	Description
Individual High Risk Reasons	Displays the overall distribution of reasons causing an API call to receive a high risk designation. The total of the numbers in this chart may exceed the total number of calls since reasons may be detected concurrently.
Individual High Risk Reasons Over Time	Displays the overall distribution of reasons causing an API call to receive a high risk designation over time. The total of the numbers in this chart may exceed the total number of calls since reasons may be detected concurrently.
Concurrent High Risk Reasons	Displays the overall distribution of concurrently detected high risk signals. The chart treats each combination of concurrently detected signals separately. For example, a detection of [Signal A]+[Signal B] would listed separately from [Signal A]+[Signal B]+[Signal C].
Concurrent High Risk Reasons Over Time	Displays the overall distribution of concurrently detected high risk signals over time. The chart treats each combination of concurrently detected signals separately. For example, a detection of [Signal A]+[Signal B] would listed separately from [Signal A]+[Signal B]+[Signal C].
High Risk Devices	Displays the overall distribution of high risk devices by their operating system.
High Risk Devices Over Time	Displays the overall distribution of high risk devices by their operating system over time.

Segment Analysis Tiles

Name	Description
Average Segment Count by Risk	Displays the average number of segments in sessions of each risk level.
Average Segment Count by Risk Over Time	Displays the average number of segments in sessions of each risk level over time.
Average Segment Count by Signal	Displays the average number of segments in sessions where the specified high risk signal was detected.
Average Segment Count by Signal Over Time	Displays the average number of segments in sessions where the specified high risk signal was detected over time.
High Risk Step Sankey	Displays the paths high risk users took to progress through the application and the frequency each path was taken
Low Risk Step Sankey	Displays the paths low risk users took to progress through the application and the frequency each path was taken

Account Defense

The Account Defense page contains two dashboards: AD Overview and Segment Analysis.

The AD Overview tab provides a summary of the high risk Account Defense interactions, including information on the reason(s) for the high risk designation, and the involved devices.

The data in this dashboard can be filtered by:

Timeframe
API Checkpoint Name
Funnel
Product
API Call Origin

The Segment Analysis tab provides details on the paths taken by users designated as high or low risk, allowing for comparison between them.

The data in this dashboard can be filtered by:

Timeframe
API Checkpoint Name
Funnel
Product
API Call Origin

AD Overview Tiles

Name	Description
Individual High Risk Reasons	Displays the overall distribution of reasons causing an API call to receive a high risk designation. The total of the numbers in this chart may exceed the total number of calls since reasons may be detected concurrently.
Individual High Risk Reasons Over Time	Displays the overall distribution of reasons causing an API call to receive a high risk designation over time. The total of the numbers in this chart may exceed the total number of calls since reasons may be detected concurrently.
Concurrent High Risk Reasons	Displays the overall distribution of concurrently detected high risk signals. The chart treats each combination of concurrently detected signals separately. For example, a detection of [Signal A]+[Signal B] would listed separately from [Signal A]+[Signal B]+[Signal C].
Concurrent High Risk Reasons Over Time	Displays the overall distribution of concurrently detected high risk signals over time. The chart treats each combination of concurrently detected signals separately. For example, a detection of [Signal A]+[Signal B] would listed separately from [Signal A]+[Signal B]+[Signal C].
High Risk Devices	Displays the overall distribution of high risk devices by their operating system.
High Risk Devices Over Time	Displays the overall distribution of high risk devices by their operating system over time.

Segment Analysis Tiles

Name	Description
Average Segment Count by Risk	Displays the average number of segments in sessions of each risk level.
Average Segment Count by Risk Over Time	Displays the average number of segments in sessions of each risk level over time.
Average Segment Count by Signal	Displays the average number of segments in sessions where the specified high risk signal was detected.
Average Segment Count by Signal Over Time	Displays the average number of segments in sessions where the specified high risk signal was detected over time.
High Risk Step Sankey	Displays the paths high risk users took to progress through the application and the frequency each path was taken
Low Risk Step Sankey	Displays the paths low risk users took to progress through the application and the frequency each path was taken

Investigation

The Investigation page contains four dashboards: Population, By Identity ID, By Registered User ID, and By Device ID.

The Population dashboard provides a risk and signal summary for a specified population of users.

The data in this dashboard can be filtered by:

Timeframe
Product
Overal Risk Level
AO Risk Level
AD Risk Level
Signal Name
Concurrent Signals
API Checkpoint Name
Funnel
ASN Name
Country
City
Zip Code
API Call Origin

The (Investigation) By Identity ID, By Registered User ID, and By Device ID tabs allow you to research activity associated with a particular Identity ID, Registered User ID or Device ID to see information regarding session history, signals detected, associations and observed behavior.

Each dashboard requires the specifying of a single ID (of the designated type).

The By ID dashboards do not contain general filters because of their highly focused nature.

Population Tiles

Name	Description
Results	Displays the total number of results matching the specified criteria.
Overall High Risk	Displays the percent of the total results with an overall high risk designation.
Overall Medium Risk	Displays the percent of the total results with an overall medium risk designation.
Overall Low Risk	Displays the percent of the total results with an overall low risk designation.
Risk Scorecard	Displays the risk breakdown, by product, for the specified population.
Signal Scorecard	Displays the volume of detected signals for the specified population. Only signals with true values show here.
Signal Scorecard Over Time	Displays the volume of detected signals for the specified population over time. Only signals with true values show here.
Population Details	Displays the ID, risk, and signal data associated with the specified population.

By Identity Tiles

Name	Description
Identity ID Overview	Displays an overview of the session(s) associated with the specified ID, including details of the associated API call(s) and response(s).
Related by Device ID	Displays similar information to the Overview tile, but for IDs related by Device ID.
Related by Registered User ID	Displays similar information to the Overview tile, but for IDs related by Registered User ID.
Observed Behavior	Provides detail regarding each interaction associated with the specified Identity ID (ex: what was interacted with, how it was interacted with, for how long, etc.)

By Registered User ID Tiles

Name	Description
Registered User ID Overview	Displays an overview of the session(s) associated with the specified ID, including details of the associated API call(s) and response(s).
Related by Device ID	Displays similar information to the Overview tile, but for IDs related by Registered User ID.
Observed Behavior	Provides detail regarding each interaction associated with the specified Registered User ID (ex: what was interacted with, how it was interacted with, for how long, etc.)

By Device ID Tiles

Name	Description
Device ID Overview	Displays an overview of the session(s) associated with the specified ID, including details of the associated API call(s) and response(s).
Related by Registered User ID	Displays similar information to the Overview tile, but for IDs related by Registered User ID.
Observed Behavior	Provides detail regarding each interaction associated with the specified Device ID (ex: what was interacted with, how it was interacted with, for how long, etc.)

By Alias ID Tiles

Name	Description
Alias ID Overview	Displays an overview of the session(s) associated with the specified ID, including details of the associated API call(s) and response(s).
Related by Device ID	Displays similar information to the Overview tile, but for IDs related by Device ID.
Related by Registered User IDs	Displays similar information to the Overview tile, but for IDs related by Registered User ID.
Observed Behavior	Provides detail regarding each interaction associated with the specified Device ID (ex: what was interacted with, how it was interacted with, for how long, etc.)

Link Analysis

Link Analysis summarizes the number of links (i.e., relationships) observed between a single device and it's associated Identity IDs, Registered User IDs, Sessions, and (Hashed) IP Addresses.

For example, you can see things like the number of times a single device was linked to a large number of (Hashed) IP addresses, drill-in to see the involved Device IDs, and then drill-in to a particular Device ID to investigate it's associations.

The data in this dashboard can be filtered by:

Timeframe
Funnel
Product
API Checkpoint Name
API Call Origin

Link Analysis Tiles

Name	Description
One Device with n Identity IDs	Displays the number of times a link was found between a single device and one or more Identity IDs, by the count of linked Session IDs. It also displays the counts of sessions associated with those links by risk level and in total.
One Device with n Registered User IDs	Displays the number of times a link was found between a single device and one or more Registered User IDs, by the count of linked Session IDs. It also displays the counts of sessions associated with those links by risk level and in total.
One Device with n Session IDs	Displays the number of times a link was found between a single device and one or more Session IDs, by the count of linked Session IDs. It also displays the counts of sessions associated with those links by risk level and in total.
One Device with n (Hashed) IP Addresses	Displays the number of times a link was found between a single device and one or more (Hashed) IP Addresses, by the count of linked Session IDs. It also displays the counts of sessions associated with those links by risk level and in total.