Risk actions, investigations and entity lookup
The Protection & Investigations group of the sidebar is where you check what your policy would do, review agent and bot traffic, and investigate a lead. Admins validate risk actions here before they move enforcement from shadow to active. Analysts use the lookup and investigation pages to follow a lead across devices and networks.
What it is
Availability: Availability depends on your plan, role and the modules enabled for your organisation.
Most pages in this group show evidence. They do not act on traffic. The table says which pages are observe-only and which carry a change you can make.
| Page | Route | Minimum role | Observe-only or actionable |
|---|---|---|---|
| Risk Actions | /risk-actions | Admin | Observe-only: shows what the pipeline would have done |
| Agentic Security | /agentic-security | Admin | Observe-only: agent verdicts, attestation chain and MCP usage |
| Bot Intelligence | /bot-intel | Admin | Observe-only: catalog and activity |
| Behavioral Corroboration, Behavioral Subjects | /behavioral, /behavioral/subjects | Admin | Advisory; one action: reset a subject baseline (MFA and confirmation) |
| Investigations | /investigations | Viewer, when enabled | Read-only views and saved views; no case actions |
| Entity Lookup | /investigation | Viewer | Lookups; sanctions screening is advisory |
| Quality & Calibration | /quality-calibration | Admin | Actionable: accept or reject calibration proposals, open and resolve disputes, import labels |
Results are signals for your own decision. A sanctions-screening match, a behavioral deviation or a bot-operator match is a lead for human review, never an automatic block. See Why calibration, not verdicts.
Enforcement itself is configured under Detection & Collection → Rules & Risk Scoring. See Detection and collection settings.
Prerequisites
- The minimum role from the table. Roles are explained in Backoffice guide.
- For Investigations: the feature enabled for your organisation and an active legal-basis receipt. Without them the page opens with an “Investigations not enabled” state, and the sidebar item stays hidden. See Legal basis register and receipts.
- For Entity Lookup enrichment: OSINT enrichment enabled for your organisation. Without it a lookup shows “Enrichment not enabled”.
- For Behavioral Corroboration: the behavioral module in your plan. Without it a strip reads “Behavioral Corroboration is not included in your plan”.
- An authenticator app. Accepting a calibration proposal and resetting a behavioral baseline ask for a fresh MFA code.
Steps
1. Validate risk actions before you enforce
Open Backoffice → Protection & Investigations → Risk Actions. The page states: “Everything here is what the pipeline WOULD have done. No policy is enforced from this page.”
- Shadow decisions count would-be policy actions. Submit shadow hits are per-submission decisions. Enforcement shadow hits are in-path allow, challenge or block decisions made while enforcement runs in shadow. Counts are approximate volumes.
- Challenge outcomes by method break down Invisible PoW and Turnstile step-up challenges into Issued, Solved, Failed and Abandoned. Challenge solve rate is solved divided by solved plus failed.
- Submit and enforcement counts cover the last 24 rolling hours. Challenge outcomes cover the current UTC day. The two windows rarely align, so a later stage can show a higher count than an earlier one.
- Live updates polls for new data. Use Refresh to reload.
A tenant admin sees only the own workspace. If the page says “Risk Actions not provisioned”, the shadow pipeline has no data yet; it is off until it is enabled for your workspace.
2. Review agent traffic in Agentic Security
Open Agentic Security. It is read-only and has three sections:
- Agent verification verdicts: Verified, Unsigned, Invalid signature, Expired and Replay over 24 hours, 7 days or 30 days.
- Attestation-chain forensics: per-agent observations recorded in shadow. Detail is hidden below a small-count threshold and only a summary shows.
- MCP token usage: queries used, period limit and remaining for the current period.
A Cloudflare Verified AI Agents panel can seed the agent registry when your deployment exposes it. Each section shows its own “not enabled” note until its rollup is on. Concepts are in Know Your Agent and Agentic Security.
3. Browse bot operators in Bot Intelligence
Bot Intelligence shows a Verified bot catalog of named operators, with source and license attribution, and Per-operator activity for your workspace over 1, 7 or 30 days. Filter the catalog by operator, slug, category or kind. The catalog is platform data; the activity is yours. Empty states distinguish “not enabled”, “waiting for upstream collection” and “no recognized bot activity in this window”.
4. Read behavioral corroboration
Behavioral Corroboration shows the enrolment funnel (learning to active), the session-deviation histogram, drift by capture channel and concordance against labeled ground truth. Behavioral Subjects lists pseudonymous subjects with status, sample count, last deviation band (low through severe) and drift time. A deviation says how consistent a session is with the subject’s own history. It is advisory evidence, never identity and never a verdict. Small groups are suppressed. On a subject page you can reset the baseline, which returns it to learning and clears learned statistics; that needs a fresh MFA check and a confirmation.
5. Investigate (when enabled)
Investigations has five tabs: Journeys (Sankey), Device Locations, Journeys (Chord), Events and Incident Triage.
- Events takes filters for risk, attestation, automation, network and account. Select Apply, then page with Load more; Download CSV exports the loaded rows.
- Journeys (Chord) shows how devices, accounts, agents and networks co-occur. Pairs below a privacy floor of 5 are not shown.
- Incident Triage is read-only: status counts and grouping of existing signals, with no case queue and no close actions.
- Save a view with the saved-views menu. Superadmins must pick a workspace first.
Reads are tenant-scoped. When the feature or the legal-basis receipt is missing, each tab shows a disabled state.
6. Look up an entity
Open Entity Lookup, enter an IP address, domain or ASN (for example 8.8.8.8, example.com, AS13335) and select Investigate. Enrichment tabs include IP, WHOIS / RDAP, BGP / ASN, DNS, Certificates, Threat intel, CVE (NVD) and GitHub. An Entity graph expands related entities. A separate sanctions search screens a name against the US OFAC Specially Designated Nationals list. The page says it is advisory, does not claim to be complete, and a match is “a lead for human review — never an automated block or decision”. Source attribution is listed under the results.
7. Work the calibration queue
Quality & Calibration has five tabs: Calibration inbox (default), Calibration concordance, FP disputes, Corpus and Shadow reports.
| Tab | What you do | Notes |
|---|---|---|
| Calibration inbox | Review proposals (Proposed, Accepted, Rejected); inspect the threshold change and its evidence; accept or reject | Propose-only. Nothing applies until you accept, and accepting needs a fresh MFA check. Each proposal shows its origin and whether AI drafted it |
| Calibration concordance | Read how each shadow candidate would change bands over a window | Read-only; never applies a change |
| FP disputes | Open, track and resolve false-positive disputes; export the list to CSV | A dispute moves from open through reviewing to upheld or overturned. Resolving is an admin action |
| Corpus | Read the labeled bot or human base rate; import labels from resolved disputes or add a manual label | A label is annotation only and never moves a scoring weight. Import and annotate need MFA |
| Shadow reports | Read a per-flag report card for each shadow signal over 24 hours, 7 days or 30 days | Recommendations are annotations. Weight changes stay a separate, explicit step |
You can also open a dispute from the Dispute Verdict button on a device record. See Fingerprints, analytics and live monitoring.
Verify it works
- Risk Actions shows non-zero shadow counts after traffic has been evaluated, or a clear “no risk-action evidence in this window” state.
- Agentic Security shows a verdict total for the window you pick, or a note naming the rollup that is off.
- Entity Lookup returns tabs of results for a valid IP, domain or ASN, or “Enrichment not enabled”.
- A calibration proposal you accept appears under Accepted after the MFA check.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| Risk Actions says “not provisioned” | The shadow pipeline and challenge ladder are off by default | Ask your account team; collect traffic after enablement |
| Counts at a later stage exceed an earlier one | Submit counts use 24 rolling hours, challenge outcomes the UTC day | Compare within one window only |
| Investigations is not in the sidebar | Feature or legal-basis receipt is not enabled | Ask your account team |
| Entity Lookup says “Enrichment not enabled” | OSINT enrichment is off for your organisation | Ask your account team |
| Bot Intelligence is empty | Named-operator collection is not enabled, or no recognized bots arrived in the window | Widen the window; ask your account team |
| Behavioral pages are empty | No subjects have enrolled | Review the behavioral settings in Detection and collection settings |
| Sanctions screening is rate limited | Too many screenings in a short time | Wait a moment and retry |
| Accepting a proposal fails | The MFA check lapsed | Enter a new authenticator code |
Related
- Detection and collection settings: enforcement mode, risk scoring and shadow candidates.
- Fingerprints, analytics and live monitoring: devices and population context.
- Know Your Agent: how incoming agents are evaluated.
- Calibration: how to read risk and confidence.
- Threat categories: public reason families.
- Roles and permissions: the capabilities behind each page.