---
title: "Risk actions, investigations and entity lookup"
description: "Use Risk Actions, Agentic Security, Bot Intelligence, Behavioral Corroboration, Investigations, Entity Lookup and Quality & Calibration to validate policy before you enforce it."
canonical_url: "https://noxtica.com/docs/backoffice/risk-actions-and-investigations/"
markdown_url: "https://noxtica.com/docs/backoffice/risk-actions-and-investigations/index.md"
last_updated: 2026-10-27
published: 2026-10-27
section: "backoffice"
section_title: "Backoffice Guide"
site: "Noxtica"
language: "en"
source: markdown
---

# Risk actions, investigations and entity lookup

The **Protection & Investigations** group of the sidebar is where you check what your policy would do, review agent and bot traffic, and investigate a lead. Admins validate risk actions here before they move enforcement from shadow to active. Analysts use the lookup and investigation pages to follow a lead across devices and networks.

## What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

Most pages in this group show evidence. They do not act on traffic. The table says which pages are observe-only and which carry a change you can make.

| Page | Route | Minimum role | Observe-only or actionable |
| --- | --- | --- | --- |
| Risk Actions | `/risk-actions` | Admin | Observe-only: shows what the pipeline would have done |
| Agentic Security | `/agentic-security` | Admin | Observe-only: agent verdicts, attestation chain and MCP usage |
| Bot Intelligence | `/bot-intel` | Admin | Observe-only: catalog and activity |
| Behavioral Corroboration, Behavioral Subjects | `/behavioral`, `/behavioral/subjects` | Admin | Advisory; one action: reset a subject baseline (MFA and confirmation) |
| Investigations | `/investigations` | Viewer, when enabled | Read-only views and saved views; no case actions |
| Entity Lookup | `/investigation` | Viewer | Lookups; sanctions screening is advisory |
| Quality & Calibration | `/quality-calibration` | Admin | Actionable: accept or reject calibration proposals, open and resolve disputes, import labels |

Results are signals for your own decision. A sanctions-screening match, a behavioral deviation or a bot-operator match is a lead for human review, never an automatic block. See [Why calibration, not verdicts](https://noxtica.com/docs/why-calibration/).

Enforcement itself is configured under **Detection & Collection → Rules & Risk Scoring**. See [Detection and collection settings](https://noxtica.com/docs/backoffice/detection-settings/).

## Prerequisites

- The minimum role from the table. Roles are explained in [Backoffice guide](https://noxtica.com/docs/backoffice/overview/).
- For Investigations: the feature enabled for your organisation and an active legal-basis receipt. Without them the page opens with an "Investigations not enabled" state, and the sidebar item stays hidden. See [Legal basis register and receipts](https://noxtica.com/docs/compliance/legal-basis/).
- For Entity Lookup enrichment: OSINT enrichment enabled for your organisation. Without it a lookup shows "Enrichment not enabled".
- For Behavioral Corroboration: the behavioral module in your plan. Without it a strip reads "Behavioral Corroboration is not included in your plan".
- An authenticator app. Accepting a calibration proposal and resetting a behavioral baseline ask for a fresh MFA code.

## Steps

### 1. Validate risk actions before you enforce

Open `Backoffice → Protection & Investigations → Risk Actions`. The page states: "Everything here is what the pipeline WOULD have done. No policy is enforced from this page."

- **Shadow decisions** count would-be policy actions. **Submit shadow hits** are per-submission decisions. **Enforcement shadow hits** are in-path allow, challenge or block decisions made while enforcement runs in shadow. Counts are approximate volumes.
- **Challenge outcomes by method** break down **Invisible PoW** and **Turnstile** step-up challenges into **Issued**, **Solved**, **Failed** and **Abandoned**. **Challenge solve rate** is solved divided by solved plus failed.
- Submit and enforcement counts cover the last 24 rolling hours. Challenge outcomes cover the current UTC day. The two windows rarely align, so a later stage can show a higher count than an earlier one.
- **Live updates** polls for new data. Use **Refresh** to reload.

A tenant admin sees only the own workspace. If the page says "Risk Actions not provisioned", the shadow pipeline has no data yet; it is off until it is enabled for your workspace.

### 2. Review agent traffic in Agentic Security

Open `Agentic Security`. It is read-only and has three sections:

- **Agent verification verdicts**: **Verified**, **Unsigned**, **Invalid signature**, **Expired** and **Replay** over 24 hours, 7 days or 30 days.
- **Attestation-chain forensics**: per-agent observations recorded in shadow. Detail is hidden below a small-count threshold and only a summary shows.
- **MCP token usage**: queries used, period limit and remaining for the current period.

A **Cloudflare Verified AI Agents** panel can seed the agent registry when your deployment exposes it. Each section shows its own "not enabled" note until its rollup is on. Concepts are in [Know Your Agent](https://noxtica.com/docs/concepts/know-your-agent/) and [Agentic Security](https://noxtica.com/docs/concepts/agentic-security/).

### 3. Browse bot operators in Bot Intelligence

`Bot Intelligence` shows a **Verified bot catalog** of named operators, with source and license attribution, and **Per-operator activity** for your workspace over 1, 7 or 30 days. Filter the catalog by operator, slug, category or kind. The catalog is platform data; the activity is yours. Empty states distinguish "not enabled", "waiting for upstream collection" and "no recognized bot activity in this window".

### 4. Read behavioral corroboration

`Behavioral Corroboration` shows the enrolment funnel (learning to active), the session-deviation histogram, drift by capture channel and concordance against labeled ground truth. `Behavioral Subjects` lists pseudonymous subjects with status, sample count, last deviation band (low through severe) and drift time. A deviation says how consistent a session is with the subject's own history. It is advisory evidence, never identity and never a verdict. Small groups are suppressed. On a subject page you can reset the baseline, which returns it to learning and clears learned statistics; that needs a fresh MFA check and a confirmation.

### 5. Investigate (when enabled)

`Investigations` has five tabs: **Journeys (Sankey)**, **Device Locations**, **Journeys (Chord)**, **Events** and **Incident Triage**.

- **Events** takes filters for risk, attestation, automation, network and account. Select **Apply**, then page with **Load more**; **Download CSV** exports the loaded rows.
- **Journeys (Chord)** shows how devices, accounts, agents and networks co-occur. Pairs below a privacy floor of 5 are not shown.
- **Incident Triage** is read-only: status counts and grouping of existing signals, with no case queue and no close actions.
- Save a view with the saved-views menu. Superadmins must pick a workspace first.

Reads are tenant-scoped. When the feature or the legal-basis receipt is missing, each tab shows a disabled state.

### 6. Look up an entity

Open `Entity Lookup`, enter an IP address, domain or ASN (for example `8.8.8.8`, `example.com`, `AS13335`) and select **Investigate**. Enrichment tabs include **IP**, **WHOIS / RDAP**, **BGP / ASN**, **DNS**, **Certificates**, **Threat intel**, **CVE (NVD)** and **GitHub**. An **Entity graph** expands related entities. A separate sanctions search screens a name against the US OFAC Specially Designated Nationals list. The page says it is advisory, does not claim to be complete, and a match is "a lead for human review — never an automated block or decision". Source attribution is listed under the results.

### 7. Work the calibration queue

`Quality & Calibration` has five tabs: **Calibration inbox** (default), **Calibration concordance**, **FP disputes**, **Corpus** and **Shadow reports**.

| Tab | What you do | Notes |
| --- | --- | --- |
| Calibration inbox | Review proposals (Proposed, Accepted, Rejected); inspect the threshold change and its evidence; accept or reject | Propose-only. Nothing applies until you accept, and accepting needs a fresh MFA check. Each proposal shows its origin and whether AI drafted it |
| Calibration concordance | Read how each shadow candidate would change bands over a window | Read-only; never applies a change |
| FP disputes | Open, track and resolve false-positive disputes; export the list to CSV | A dispute moves from open through reviewing to upheld or overturned. Resolving is an admin action |
| Corpus | Read the labeled bot or human base rate; import labels from resolved disputes or add a manual label | A label is annotation only and never moves a scoring weight. Import and annotate need MFA |
| Shadow reports | Read a per-flag report card for each shadow signal over 24 hours, 7 days or 30 days | Recommendations are annotations. Weight changes stay a separate, explicit step |

You can also open a dispute from the **Dispute Verdict** button on a device record. See [Fingerprints, analytics and live monitoring](https://noxtica.com/docs/backoffice/fingerprints-and-analytics/).

## Verify it works

- **Risk Actions** shows non-zero shadow counts after traffic has been evaluated, or a clear "no risk-action evidence in this window" state.
- **Agentic Security** shows a verdict total for the window you pick, or a note naming the rollup that is off.
- **Entity Lookup** returns tabs of results for a valid IP, domain or ASN, or "Enrichment not enabled".
- A calibration proposal you accept appears under **Accepted** after the MFA check.

## Troubleshooting

| Symptom | Cause | Fix |
| --- | --- | --- |
| Risk Actions says "not provisioned" | The shadow pipeline and challenge ladder are off by default | Ask your account team; collect traffic after enablement |
| Counts at a later stage exceed an earlier one | Submit counts use 24 rolling hours, challenge outcomes the UTC day | Compare within one window only |
| Investigations is not in the sidebar | Feature or legal-basis receipt is not enabled | Ask your account team |
| Entity Lookup says "Enrichment not enabled" | OSINT enrichment is off for your organisation | Ask your account team |
| Bot Intelligence is empty | Named-operator collection is not enabled, or no recognized bots arrived in the window | Widen the window; ask your account team |
| Behavioral pages are empty | No subjects have enrolled | Review the behavioral settings in [Detection and collection settings](https://noxtica.com/docs/backoffice/detection-settings/) |
| Sanctions screening is rate limited | Too many screenings in a short time | Wait a moment and retry |
| Accepting a proposal fails | The MFA check lapsed | Enter a new authenticator code |

## Related

- [Detection and collection settings](https://noxtica.com/docs/backoffice/detection-settings/): enforcement mode, risk scoring and shadow candidates.
- [Fingerprints, analytics and live monitoring](https://noxtica.com/docs/backoffice/fingerprints-and-analytics/): devices and population context.
- [Know Your Agent](https://noxtica.com/docs/concepts/know-your-agent/): how incoming agents are evaluated.
- [Calibration](https://noxtica.com/docs/concepts/calibration/): how to read risk and confidence.
- [Threat categories](https://noxtica.com/docs/threat-categories/): public reason families.
- [Roles and permissions](https://noxtica.com/docs/security/roles-and-permissions/): the capabilities behind each page.