Dark
Request a walkthrough
On this page
Developer overview

Fingerprints, analytics and live monitoring

The Device Intelligence group of the sidebar holds the pages for reading what the collector scored. Analysts and operators use them to find a device, understand its score, compare it with another device and see where risk concentrates. This page covers each page, what it shows and what you can do on it.

Key points

  1. Search by device, IP, ASN or user agentFingerprints filters by risk, country, collection method and hardware attestation; rows refresh every 5, 15 or 30 seconds.
  2. A device record explains its scoreThe Overview tab ranks the signals behind the score; Sessions timeline covers the last 90 days of replay sessions that are still retained.
  3. Compare takes two to four devicesSelect rows and choose Compare to see highlighted differences across tabs.
  4. Hidden buckets are not zerosPopulation, Geo-risk and the verdict funnel hide small groups for privacy.
  1. What it is
  2. Prerequisites
  3. Steps
  4. Verify it works
  5. Troubleshooting
  6. Related
How this page is organisedBar length shows each section’s share of the text. Select a section to jump to it.

What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

Every page here reads the active workspace. Results are signals for your own policy, not verdicts about a person: a fingerprint is a scored device observation, and a relation between two devices is a lead for review. See Why calibration, not verdicts.

PageRouteMinimum roleUse it to
Risk Analytics/analyticsViewerRead key metrics, trends, risk distribution, signals and geography for a time range and domain
Traffic Intelligence/insightsAdminRead summaries of bot-versus-human share, AI-crawler traffic, geography against risk and anomalies; observe-only
Dashboards/dashboardsViewer to read, Admin to changeBuild dashboards, reusable cards and cohort analyses
Fingerprints/fingerprintsViewerSearch, filter and open real device records
Live Fingerprints/fingerprints/live-monitoringViewerWatch devices arrive in near real time
Compare Fingerprints/fingerprints/compareViewerDiff up to four devices
Fingerprint Population/fingerprints/populationViewerRead fleet-wide hardware and attestation distributions
Related Devices/fingerprints/linkageViewer, when enabledReview advisory candidate relations between devices
Geo-risk/geo-riskAdminSee risk bands per country, network (ASN) and IP block
Hardware Attestation/hardware-attestationAdminRead GPU and CPU attestation distributions, GPU detail and mobile attestations
Issues/issuesViewerTriage grouped errors and behavior signals

Some pages show an empty or “not enabled” state until the underlying rollup or module is turned on for your organisation. An empty state is not evidence of no traffic.

Prerequisites

  • A workspace with at least one registered domain that sends traffic. See Domains, site keys and the install card.
  • The minimum role in the table. Roles are explained in Backoffice guide.
  • For Hardware Attestation: the attestation module in your plan and attestation enabled for the domain. See Device and app attestation.
  • For Related Devices: the feature enabled for your organisation and a recorded legal basis for investigations. Without them the page opens with a disabled state.

Steps

1. Find a device in Fingerprints

Open Backoffice → Device Intelligence → Fingerprints.

  • Search accepts a device ID, IP address, ASN or user-agent text.
  • Filters cover Risk (Critical, High, Medium, Low, Minimal, Unknown), Country, the collection Method (native, sealed, sealed with encryption) and Hardware Attestation (attested or not attested).
  • The Devices tab lists devices. The User Agents tab lists each distinct user-agent string with counts and a copy action.
  • The list refreshes itself every 5, 15 or 30 seconds. Use Pause and Resume, or Refresh.
  • Pick the page size from 25, 50 or 100 rows. Selections persist across pages and filter changes.
  • Tick 2 to 4 rows and choose Compare, or choose Export to open Exports with your current filters filled in. Exports are described in Audit log and data export.

2. Read a device record

Select a row. The record opens at /fingerprints/<device id> with tabs:

TabWhat it shows
OverviewScore, risk band, confidence, flags, and a ranked “Why this score” breakdown with no personal data
Sessions timelineReplay sessions captured for this device in the last 90 days that are still within replay retention (7 days by default), newest first; plus a 7-day activity strip of visits, submissions and risk signals (dates in UTC)
Browser, Network, HardwareCollected browser, network and hardware signals
BehavioralBehavioral subscore and signals, when collected
TechniquesWhich collection techniques were switched on for this submission
PopulationWhere this device sits in your fleet distributions
EventsEvent timeline for the device
HistoryPrior scores
RawThe raw submission; visible to platform superadmins only

Header actions include Copy ID, Compare, View journeys, View heatmap, View in Investigations (when enabled) and Open in…. When disputes are enabled for your workspace, the Overview tab offers Dispute Verdict to open a false-positive dispute; the dispute goes to the review workflow described in Risk actions, investigations and entity lookup. The sessions timeline says “One device only”: it does not merge identities.

3. Watch live traffic

Open Device Intelligence → Live Fingerprints. The page streams recent visits and submissions with a location map.

  • KPI tiles: Active devices, Active now, Devices seen (history), Visits, Submissions, High / Critical.
  • Filter the stream by risk level, pause and resume it, and choose a polling interval of 5, 15 or 30 seconds.
  • Select a row to open the device record.
  • The history panels can lag. The page states the lag: history up to the shown window, which “may lag up to ~15 min”. If the real-time read fails, the page says so and shows delayed history instead.

4. Compare devices

Select 2 to 4 rows on Fingerprints and choose Compare, or open /fingerprints/compare?ids=<a>,<b>. Tabs: Overview, Signals, Signal data, Environment, Raw. Differences are highlighted; flags are split into common and only-in-one-device. If a device ID exists in more than one workspace you can reach, pick the tenant for each slot.

5. Read population statistics

Open Fingerprint Population for fleet-wide distributions over a window of 24 hours, 7 days or 30 days, filtered by signal family. Buckets with too few devices are hidden before they reach the page, and hidden buckets are excluded from every total. The page never identifies an individual device and changes no detection behavior. Use a device’s Population tab to see where one device sits.

Related Devices lists candidate relations: two device IDs that share signals, with a confidence (High, Medium, Low), an ordinal score from 0 to 100 for ranking, the link types and the itemised evidence and counter-evidence. A relation expires. It never merges devices and never feeds a score or verdict. The page states that edge precision and 7-day re-link recall have not been evaluated, so treat each relation as a lead, not as proof that one operator controls both devices.

7. Use Risk Analytics and Dashboards

Risk Analytics has the tabs Trends, Distribution, Signals and Geography, a Time range, a Breakdown dimension (Country, City, Platform, ASN) and key figures: Total submissions, Critical rate, High risk and a device count. Use CSV buttons to download a chart’s data. Views → Save current view… stores the time range, filters and toggles as a preset that only you can see.

Dashboards has the tabs Dashboards, Cards and Cohorts. Build operator views from funnels, journeys, heat maps, web vitals, dimensions, retention and feature adoption. Viewers and Analysts read them. Creating or changing a dashboard, card or cohort needs the Admin role and a fresh MFA check.

8. Read Geo-risk and Hardware Attestation

  • Geo-risk (Admin) has the tabs Country, ASN and IP block over 7, 30 or 90 days, with a map. Cells below the privacy floor are suppressed. Without the underlying rollup the page says “Not enabled yet”.
  • Hardware Attestation (Admin) has Distribution, GPU detail and Mobile attestations. The mobile tab is a read-only ledger of Android and iOS attestation results for the workspace, with Play Integrity and App Attest verdicts shown as recorded. If too few records exist, the ledger hides individual rows. Register your apps under Integrations & API → Attestation Apps; see Device and app attestation.

9. Triage Issues

Issues groups runtime errors and deterministic behavior signals. The Errors and Behavior tabs take filters for severity, type, route, release and device. Severity is a deterministic impact rule: occurrences multiplied by affected users (1,000 or more is Critical, 100 or more High, 10 or more Medium, otherwise Low), with a High floor on checkout, payment and billing routes. It is not AI grading. Error capture is covered in Browser errors, console logs and source maps.

  1. Find the device

    Search Fingerprints by device ID, IP, ASN or user agent.

  2. Read the record

    Open the row and read Overview, Sessions timeline and signal tabs.

  3. Check live traffic

    Open Live Fingerprints and filter the stream by risk level.

  4. Compare devices

    Select 2 to 4 rows and choose Compare.

  5. Add population context

    Use the Population tab, Geo-risk and Risk Analytics for fleet context.

  6. Act in your own policy

    Dispute a verdict or move to risk actions; treat results as signals.

Investigate a device in Backoffice

Verify it works

  • A device you know sent traffic appears on Fingerprints after a search by its device ID, and its record opens with a score, a band and the Why this score breakdown.
  • Live Fingerprints shows Streaming and your visit appears within one polling interval.
  • On a comparison, selected devices show a difference count and highlighted rows.
  • Risk Analytics → Trends shows non-zero Total submissions for the chosen range.
  • If a page shows “not enabled”, “Rollup disabled” or an empty table, widen the range and confirm traffic exists before you conclude anything.

Troubleshooting

SymptomCauseFix
Fingerprints is emptyNo traffic yet, a filter is narrowing the list, or the domain’s collector is not installedSelect Clear filters; check Last seen on Domains
Live Fingerprints shows “Real-time read unavailable”The real-time read failed; delayed history is shown insteadRetry; history panels are unaffected
Raw tab is missingThe raw submission is visible to superadmins onlyUse the other tabs
Compare asks you to pick a tenantThe device ID exists in more than one workspaceChoose the tenant for that slot
Population or Geo-risk hide a bucketThe bucket is below the privacy floorWiden the window; a hidden bucket is not a zero
Geo-risk shows “Not enabled yet”The rollup is not enabled for your organisationAsk your account team
Related Devices shows a disabled stateFeature or investigation legal basis is not in placeAsk your account team; see Legal basis register and receipts
Hardware Attestation tabs are emptyAttestation is not enabled for the domain, or no attested traffic has arrived yetSee Device and app attestation
A dashboard or card will not saveChanges need the Admin role and an MFA checkEnter the authenticator code