Relationship between events, devices and risk signals

Each identification request creates an event uniquely identified by request_id. Within the same application and Region, events that return the same device_id are grouped into a device. An event can trigger zero or more risk signals, while the device page aggregates signals from related events that remain within the current data-retention period.

For detailed procedures and field definitions, see:

• Event Investigation for searching events and reviewing event details and raw data.
• Device Analysis for Device ID aggregation scope and changes in the device environment.
• Risk Signals for signal severity, platform support, and recommended actions.

Dashboard drill-down flow

flowchart LR
    SIGNAL_PAGE[Risk signal card]
    EVENT_LIST[Pre-filtered event list]
    EVENT_DETAIL[Event details]
    VISITOR_DETAIL[Device details]
    VISITOR_EVENT[Device event history]

    SIGNAL_PAGE -->|View logs with application, time, and signal filters| EVENT_LIST
    EVENT_LIST -->|Select an event row or Details| EVENT_DETAIL
    EVENT_DETAIL -->|Select Device ID| VISITOR_DETAIL
    VISITOR_DETAIL -->|Select Request ID| EVENT_DETAIL
    VISITOR_DETAIL --> VISITOR_EVENT

You can move between Risk Signals, Events, and Devices while retaining the relevant application, time-range, and filter context. Available entry points depend on the current dashboard version; see the corresponding guide for details.