Relationship between events, visitors and risk signals

How a request forms an event

When a client calls Geelab SDK to initiate an identification request, the system will first verify the organization, application, endpoints and Public API Key to which the request belongs, and check the source domain name, Bundle ID, Package Name or application signature according to the platform configuration.

After the request is processed, Geelab generates a unique request_id and forms an event record. The event can be used to:

• Search precisely in the event list.
• Associated with customer server logs or business orders.
• Locate the original identification request in the webhook delivery log.
• View the device and risk details for this request.

How multiple events are aggregated into a visitor

If multiple events return the samedevice_id, the console aggregates these events into the same visitors view within the current app's data scope.

Event A: request_id=req_001, device_id=dev_123
Event B: request_id=req_002, device_id=dev_123
Event C: request_id=req_003, device_id=dev_456

Aggregation result:
- Visitor dev_123: contains Events A and B
- Visitor dev_456: contains Event C

Unless the product explicitly states otherwise, do not assume that the same device_id can be directly correlated across applications or Regions.

How a single event hits multiple risk signals

{
  "request_id": "req_001",
  "device_id": "dev_123",
  "signals": [
    { "signal_code": "EMULATOR" },
    { "signal_code": "TAMPER_TOOL_INSTALLED" }
  ]
}

Penetration relationships in the console

mermaid
flowchart LR
    SIGNAL_PAGE[Risk signal card]
    EVENT_LIST[Pre-filtered event list]
    EVENT_DETAIL[Event details]
    VISITOR_DETAIL[Visitor details]
    VISITOR_EVENT[Visitor event history]

    SIGNAL_PAGE -->|View logs with application, time, and signal filters| EVENT_LIST
    EVENT_LIST -->|Select an event row or Details| EVENT_DETAIL
    EVENT_DETAIL -->|Select Device ID| VISITOR_DETAIL
    VISITOR_DETAIL -->|Select Request ID| EVENT_DETAIL
    VISITOR_DETAIL --> VISITOR_EVENT

Enter events from risk signals

After clicking "View Log" on the Risk Signals page, the console enters the event list and automatically brings in:

• The currently selected application.
• Current time frame.
• Current risk signals.

Enter visitors from event

In event details, use device_id to view the associated visitor and learn about other events and historical context for the device during the data-retention period.

Return event from visitor

The visitor detail page displays the event log and its request_id. Click a Request ID to reopen the corresponding event and confirm the risk signals and device environment at that time.