Investigate risk signals

Enter the event from the signal card

Click View Log on the signal card, and the system will enter the event page and bring in the current investigation conditions:

• Current application.
• Current time frame.
• Current Signal Code.

You can continue to add Request ID, Device ID or IP address filters to view specific events.

View the associated Request ID and Device ID

In the event list, use Request ID to locate a specific request or Device ID to continue into device history. This page does not duplicate the Events and Devices procedures; see Event Investigation and Device Analysis.

Combine multiple signals to judge

A single signal may have multiple interpretations. A more reliable way to investigate is to combine:

• Other signals hit by the same event.
• Historical events for the same Device ID.
• Account, order, registration, and login behavior.
• IP, device type and client platform.
• level together with confidence.

For example, a VPN signal by itself may reflect normal privacy use. Combining it with an unusual device environment, a high request volume over a short period, and associations with multiple accounts supports a more informed risk assessment.