---
title: "Detection and collection settings"
description: "Tune rules, risk scoring, client cost levels, verdict bands, honeypots, the collector refresh interval, probes and behavioral signals, and roll changes out in a safe order."
canonical_url: "https://noxtica.com/docs/backoffice/detection-settings/"
markdown_url: "https://noxtica.com/docs/backoffice/detection-settings/index.md"
last_updated: 2026-10-27
published: 2026-10-27
section: "backoffice"
section_title: "Backoffice Guide"
site: "Noxtica"
language: "en"
source: markdown
---

# Detection and collection settings

The **Detection & Collection** group holds seven pages that change how Noxtica scores traffic and what the collector asks of a visitor's browser. A workspace Admin changes them. This page says what each setting changes and gives an order for rolling a change out so that live traffic is never surprised.

## What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

All seven pages are Admin pages in the sidebar. Every change is audited and asks for a fresh MFA check. Several settings have two keys: your switch, and a platform switch that Noxtica operations controls. Turning on your key does nothing visible until the platform key is also on, and a page says so next to the switch.

| Page | Route | What it changes |
| --- | --- | --- |
| Rules & Risk Scoring | `/detection/rules` | Ordered enforcement rules, the stage of enforcement, signal weights, risk-level cutoffs, shadow candidates |
| Client Cost Levels | `/detection/client-cost-levels` | How much work a visitor's browser does, per domain |
| Verdict Bands | `/detection/verdict-bands` | Staging of replay protection and binding; sealed results |
| Honeypots & Shared Intel | `/detection/honeypots` | Decoy tripwires; contribution to and use of shared intelligence |
| Collector | `/detection/collector` | Session-token refresh interval |
| Probes | `/detection/probes` | DNS-leak, extension, location and device-recognition probes |
| Behavioral Signals | `/detection/behavioral-signals` | Behavioral capture, movement tracks and behavior flags |

Several of these settings read personal data from visitors' browsers. Noxtica provides the mechanism; the legal basis is yours. Link your decisions to [Legal basis register and receipts](https://noxtica.com/docs/compliance/legal-basis/) and [Cookies, storage and consent categories for your site](https://noxtica.com/docs/compliance/cookies-and-storage/).

## Prerequisites

- The Admin role in the workspace. See [Backoffice guide](https://noxtica.com/docs/backoffice/overview/).
- An authenticator app for the step-up check.
- At least one domain with traffic, so shadow evidence can accumulate. See [Domains, site keys and the install card](https://noxtica.com/docs/backoffice/domains/).
- For behavioral capture, movement tracks, the extension probe, the location probe and persistent device recognition: counsel review and end-user consent where the law requires it. The page shows a warning next to each switch.

## Steps

### 1. Plan the rollout order

Change one thing at a time and watch the evidence before the next change.

1. Collection cost first: **Client Cost Levels** and **Collector** change load, not decisions.
2. Collection additions next: **Probes** and **Behavioral Signals**, each with a recorded legal basis.
3. Scoring: **Risk scoring** weights and cutoffs, tested with **Shadow candidates** and **Simulate & evidence** before you save.
4. Enforcement: write **Rules**, set **Enforcement mode** to **Shadow**, read [Risk actions, investigations and entity lookup](https://noxtica.com/docs/backoffice/risk-actions-and-investigations/), and only then consider **Active**.
5. Protection bands: move **Verdict Bands** from off to shadow, observe, then active.

### 2. Write rules and set the enforcement stage

Open `Detection & Collection → Rules & Risk Scoring`. The page has four tabs: **Rules**, **Simulate & evidence**, **Risk scoring** and **Shadow candidates**.

- **Rules** is an ordered list. Rules run by ascending priority, and the earliest matching rule picks the action. Actions are **Allow**, **Challenge**, **Block** and **Tarpit**. A rule can match on risk band, fired flags, agent verdict, URL path, device score, device properties, IP reputation or a flag prefix, and a per-rule challenge method (**Invisible proof-of-work** or **Turnstile**). A workspace can hold up to 100 rules.
- **Enforcement mode** has three stages. **Off** forwards every request. **Shadow** evaluates your rules and logs the would-be action without acting; this is the recommended first stage. **Active** acts on matches: block, challenge or tarpit. Changing the mode needs MFA, and switching to Active asks you to confirm.
- A rule acts only when the mode is Active and the rule's own **Shadow** switch is off. Otherwise it observes. Each rule shows "Observing" or "Enforcing" with the reason.
- Selecting Active also depends on a platform enforcement switch that Noxtica operations controls. You can stage Active in advance, and it takes effect when that switch is on.
- **Simulate & evidence** dry-runs a rule against recent events and shows the daily fire mix, so you can size a rule before you arm it.
- **Revisions & rollback** publishes the live rule set as a numbered revision and can roll back to an older one. History is never rewritten.
- Domain-scoped rules are also available on a domain's **Risk rules** tab and apply alongside tenant-wide rules.

### 3. Tune risk scoring

On the **Risk scoring** tab you can change the weight of each signal and the four cutoffs that map a score to a risk band. Cutoffs must stay strictly ordered: Critical above High above Medium above Low. A signal you turn off is ignored. High-confidence bot signals are marked **Critical signal** and only a platform superadmin can change or disable them. **Estimate impact** previews how a change would shift the band mix over recent traffic without applying it. **Reset to defaults** clears your overrides.

On the **Shadow candidates** tab, author alternative weightings. A candidate runs in a shadow pass, records a delta against the production verdict for the concordance view, and never changes a live verdict. Use **Traffic impact** to estimate flips. Accepting a change into production is a separate, deliberate step in [Risk actions, investigations and entity lookup](https://noxtica.com/docs/backoffice/risk-actions-and-investigations/).

### 4. Set Client Cost Levels

Open `Client Cost Levels`, pick a domain, and choose **Off**, **Light**, **Standard** or **High** for each of three costs:

| Cost | What it controls |
| --- | --- |
| Proof-of-work & challenge cost | How deep the CPU and GPU proof-of-work ladder runs, and whether the challenge prefers proof-of-work over Turnstile. Off skips proof-of-work |
| Detection probes cost | Which client-side probes run. Off disables every probe on the domain |
| Session-replay capture cost | Replay sampling, throttling and network-body capture. Saving any level needs an active session-replay legal-basis receipt |

Standard is the default behavior. Higher levels detect more and ask more of every visitor's device. The page suggests Light for checkout flows. The cost lands on the visitor's device, so no level needs extra sign-off. Any effective replay rate below 100 percent records no anonymous web visitors.

### 5. Stage Verdict Bands and sealed results

`Verdict Bands` has two sections.

- **Sealed Runtime security bands**: **Replay protection mode** and **Binding mode**. Each moves **Off → Shadow → Active**. Off and shadow do not enforce. Active becomes selectable once a band is in shadow. In Active the replay band can block live submissions, subject to the platform enforcement switch. The binding band is signal-only in this iteration: Active does not block.
- **Sealed results**: turn on **Emit sealed results** and the submit response carries an encrypted envelope that only your backend can open. It restores the detailed flags withheld from the browser response. Your server fetches the key with a secret API key that carries the `read:sealed_results` scope, then opens the envelope. The console never shows the key. See the [Server API overview](https://noxtica.com/docs/api/).

### 6. Honeypots and shared intelligence

On `Honeypots & Shared Intel`, **Enable honeypot tripwires** arms decoy routes, decoy form fields and per-session canary tripwires. A tripped wire raises a risk signal for your rules and never blocks a visitor on its own. The page shows anonymous daily counts per tripwire (**Hits (7d)**). **Rotate canary** invalidates current per-session canaries and needs MFA. Detection stays inactive until the platform also arms honeypots for your workspace.

**Federated intelligence** has two independent switches: **Contribute** reports an anonymized, tenant-blinded marker when a cluster escalates; **Consume** lets scoring read a shared signal that exists only after several workspaces flagged the same cluster. Both default to off.

### 7. Set the Collector refresh interval

On `Collector`, **Token refresh interval** controls how often the script refreshes its session token. Options: 30 seconds, 1 minute, **5 minutes (default)**, 15 minutes, 1 hour, 6 hours, 24 hours, or **Use plan default**. Your plan sets a floor; a value below it is refused. Lower values are more responsive and cost more infrastructure. **Effective** shows the value in force. A single domain can override the interval on its detail page. New sessions use the new interval.

### 8. Toggle probes and behavioral signals

`Probes` has four sections. Each is a switch with a warning.

| Probe | What it does | Notes |
| --- | --- | --- |
| DNS-leak probe | Compares the observed DNS resolver with the client network | Default off. Needs the platform switch as a second key |
| Extension probe | Probes a short list of high-signal browser extensions; stores a one-way hash and a count, not the list | On Chromium browsers it causes one expected console error line per page view. Never used to auto-block |
| Geo probe | Reads precise location only when the browser has already granted permission; never prompts | Only a coarse bucket is emitted |
| Persistent device recognition | Recognizes a returning device with a daily-rotating token keyed to a clearable first-party ID | Off by default. The page calls it the most legally sensitive setting. Recognition only; never used to auto-block |

`Behavioral Signals` has three sections: **Behavioral biometrics** (mouse, click and scroll patterns for a per-domain behavioral subscore; disabled by default and classified as biometric data under the GDPR), **Behavioral path tracks** (a higher-risk category: pointer and touch path geometry; turning it off permanently deletes stored path records), and **Behavioral flags** (server-derived flags from session aggregates such as no interaction; default off, with a platform switch as the second key).

## Verify it works

- After saving, the page shows a success message and the **Last changed** time.
- After you set a rule to shadow, the rule card reads "Observing (shadow)" and **Would have fired** counts grow with traffic.
- **Effective** on the Collector page shows the interval you chose.
- A verdict band set to Shadow shows no blocking; check Risk Actions for would-be decisions.
- Every change appears in the [audit log](https://noxtica.com/docs/security/audit-log-and-exports/).

## Troubleshooting

| Symptom | Cause | Fix |
| --- | --- | --- |
| Switch is on but nothing changes | The platform key for that feature is off | Ask your account team to confirm the platform switch |
| **Active** is greyed out for a band | The band is Off | Move it to Shadow first and observe |
| Rules log matches but do not act | Mode is Off or Shadow, or the rule's Shadow switch is on | Set mode to Active and turn off the rule's Shadow switch when evidence supports it |
| Thresholds will not save | Cutoffs are not strictly ordered | Keep Critical above High above Medium above Low |
| A signal cannot be changed | It is a critical signal | Only a platform superadmin can change it |
| Cost level will not save for replay | No active session-replay legal-basis receipt | Record one under Web Analytics & Privacy → Capture Policies |
| Interval below plan floor | The plan sets a minimum | Choose a larger value or **Use plan default** |
| Adding a rule fails with "Rules are limited to 100 per tenant" | The workspace holds 100 rules | Delete or merge rules |

## Related

- [Risk actions, investigations and entity lookup](https://noxtica.com/docs/backoffice/risk-actions-and-investigations/): read shadow evidence before you go Active.
- [Domains, site keys and the install card](https://noxtica.com/docs/backoffice/domains/): per-domain tracker policy and token refresh.
- [Consent modes, GPC and Google Consent Mode](https://noxtica.com/docs/sdk/consent/): what the browser does without consent.
- [Protected actions: client trigger and server check](https://noxtica.com/docs/sdk/protected-actions/): protect login and checkout.
- [Why calibration, not verdicts](https://noxtica.com/docs/why-calibration/): map risk and confidence to your policy.
- [Legal basis register and receipts](https://noxtica.com/docs/compliance/legal-basis/): record the basis for optional collection.