Analytics

Use Analytics to find a check or account, compare activity over time and export identifications for further analysis.

​

Five tabs

The selected period determines which activity is included. Identity categories have their own risk-history scope and freshness; they are not the maximum score of the selected rows. See Identity risk.

​

Risk band filters

Select Trusted, Suspicious or Dangerous to narrow the active tab. On Identifications this filters the numeric check score. On identity tabs it filters the category of each identity. An identity filter does not require every check in the selected period to have that risk band. See current category meanings.

​

The chart

The chart groups activity into time buckets. On identity tabs it counts distinct identities in each bucket; an identity can appear in several buckets, so chart points do not sum to the overall unique count. It follows the active period, domains and filters. With Trusted, Suspicious or Dangerous selected, categories appear as separate lines: checks use their Risk Scores, while visitors, users, devices and public IPs use their current risk categories. Dashed lines mark incomplete data, rather than no activity. See Analytics chart.

​

Filters

Use Filters to narrow activity by High-Risk Events, country, browser, OS, device type, connection type, domain, channel, source, campaign, entry page or risk signal. Apply the selection and inspect the active filter chips. Remove a chip to widen the view. The High-Risk Event filter uses account evidence. Read freshness and coverage indicators when interpreting an event-filtered result.

​

Filter by account or device count

For Multi-accounting and Account sharing, you can set the minimum reported count to include in the results:

1. Open Filters and choose High-Risk Events.
2. Select Medium or High for the event you want to inspect.
3. Select the pencil beside from N accounts or from N devices, enter the minimum count, and select the checkmark.
4. Apply the filters. Save the selection in Views if you want to reuse it.

For example, Multi-accounting from 5 accounts includes reported groups with at least five accounts. Account sharing from 6 devices includes account-sharing results with a reported count of at least six devices. The confidence selection still applies. These controls filter existing event results in Analytics. They do not change the detection rules, trigger a new evaluation or change which webhook events ShieldLabs sends. For the meaning of reported device counts and lower bounds, see Account-sharing counts.

​

Saved views

Use Views to save a named filter combination. Apply, update, rename or delete the view from the same menu.

​

The table

Use Columns to choose identifiers, source fields, network fields and risk details. Identification flags use grouped analytics dashboard labels; consult Risk signals for the underlying detections. Search by the appropriate identifier. On an identity tab, search by that identity’s key. On Identifications, choose an Identification ID, User HID, Device ID, Visitor ID, session, cookie or IP search as needed. Risk and event enrichment may load separately from the check rows. Read an unavailable value as unavailable evidence, and open the card to inspect the associated state. The Visitor risk, User risk, Device risk and IP risk columns show the current category of each linked identity. Each considers the share of suspicious and dangerous identifications in its own history. These columns can differ from the Risk Score of the row’s identification. High-Risk Events are shown separately. See the four identity risk categories. On Users, Unique visitors, Devices and Public IPs, Identifications counts that identifier’s saved checks in the selected period. It is separate from remaining plan volume. See Identifications.

​

Export

Export downloads identifications matching the current filter, including when started from an identity tab. It exports activity, not a deduplicated list of people. The current export limit is 10,000 rows; narrow larger selections. Exports do not consume identification quota.

​

Open a row

Select an Identification ID for the identification card, or a User HID, Device ID, Visitor ID or IP for its entity card. A user card includes event clusters and their evidence.