Entity cards

Open an entity card to investigate one user, device, visitor or public IP. The card brings together its current risk, activity in the selected period, connections and available event evidence.

​

Open a card

Select an identifier in Analytics, an identification card, or a linked-identity list. Keep the domain scope in view when following connections.

​

The header

The header shows the identifier, First seen, Last seen, and current Trusted, Suspicious or Dangerous risk category. Current risk as of gives the category’s calculation time, helping assess freshness, especially with incomplete data. If the category cannot be calculated, the dashboard shows Risk unavailable rather than Trusted. User cards also show High-Risk Event tags with Medium or High confidence. The category considers the proportion of suspicious and dangerous identifications linked to the card’s Visitor ID, User HID, Device ID or public IP. The latest check can have a different risk band from the card’s current category. User cards show High-Risk Events separately. Read the header’s current category as follows:

• Trusted: the recorded history has not raised the category.
• Suspicious: the share of suspicious identifications indicates elevated risk.
• Dangerous: the share of dangerous identifications indicates high risk.

These labels summarize the card’s own identification history. See current category meanings. First seen, Last seen, the Trusted, Suspicious and Dangerous split, and the Identifications list refer to the selected period. The current category uses the identifier’s history separately from one check’s Risk Score. The activity split and current category can differ because they use different scopes. See Identity risk.

​

Details and linked identities

Details lists counters for linked identifiers, addresses and environment attributes. Depending on the card, these can include Session ID, Device, Visitor, User, Cookie ID, Public IP, Local IP, countries, Connection type, OS, Browser and Device type. Expand a counter to inspect values and associated identification counts. Linked User, Visitor, Device and Public IP values open their own Entity cards. An IP can be shared by a household or organization. Use the actual connection evidence before treating linked accounts as the same person.

​

High-Risk Event clusters

User cards show High-Risk Event clusters for Multi-accounting, Account sharing, Impossible travel and Account takeover. Clusters lists the event type, Medium or High confidence and domain. Confidence describes the event and does not add to the check’s Risk Score. Until you select a cluster, the graph asks you to choose one from the list. The graph shows saved evidence for the selected event:

• Read the event type, confidence and domain.
• Select a node to inspect its available details or open a linked card or identification.
• Use zoom, Center and Reset view to navigate; fullscreen provides more space.
• Read the evidence window and any partial or missing-evidence notice.

The graph uses the latest retained event evidence, with a 90-day evidence window. The selected Analytics period does not redefine that graph as a complete historical replay. A partial graph can omit evidence; an empty selection may simply mean no cluster is selected. Webhooks and the History API do not return this graph or the dashboard card itself.

​

Visit connections

Where available, Visit connections presents relationships from the loaded identifications. These links describe observed activity. High-Risk Event clusters carry detector evidence and should be read separately.

​

Device, visitor and public IP cards

Use Linked accounts on a device or IP card to review account activity associated with that identity. A visitor card represents a visitor based on a cookie and a device. Follow the identifiers and evidence shown by the analytics dashboard.

​

Identifications

The identification list shows the checks in the card’s activity scope. Open a row to inspect its score, signals, identifiers, network and traffic source. This is the path from an aggregate risk category to a specific observation. Next: Investigate a user, High-Risk Events, History API.