FAQ

What is the difference between devices and events?

An event represents one identification request; a device groups activity for a device by Device ID. For event filters, fields, and details, see Event Investigation.

Why is first-seen time not the first time the device is used?

The page displays the first-seen time within the current data retention period, and earlier records may no longer be available for query.

Why are there multiple browsers or systems for the same Device ID?

It may be a browser update, system upgrade, machine change or access to different platforms. Please judge based on event time and risk signals.

Does a device hitting a risk signal mean there is a problem with the user?

Not necessarily. Risk signals are investigation leads, not final conclusions. For definitions and recommended actions, see Risk Signals.

Why is there no earlier record in the event log?

Earlier events may have exceeded the package data retention period, or the current account does not have permission to view related data.