Fingerprints, analytics and live monitoring

The Device Intelligence group of the sidebar holds the pages for reading what the collector scored. Analysts and operators use them to find a device, understand its score, compare it with another device and see where risk concentrates. This page covers each page, what it shows and what you can do on it.

What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

Every page here reads the active workspace. Results are signals for your own policy, not verdicts about a person: a fingerprint is a scored device observation, and a relation between two devices is a lead for review. See Why calibration, not verdicts.

Some pages show an empty or “not enabled” state until the underlying rollup or module is turned on for your organisation. An empty state is not evidence of no traffic.

Prerequisites

• A workspace with at least one registered domain that sends traffic. See Domains, site keys and the install card.
• The minimum role in the table. Roles are explained in Backoffice guide.
• For Hardware Attestation: the attestation module in your plan and attestation enabled for the domain. See Device and app attestation.
• For Related Devices: the feature enabled for your organisation and a recorded legal basis for investigations. Without them the page opens with a disabled state.

Steps

1. Find a device in Fingerprints

Open Backoffice → Device Intelligence → Fingerprints.

• Search accepts a device ID, IP address, ASN or user-agent text.
• Filters cover Risk (Critical, High, Medium, Low, Minimal, Unknown), Country, the collection Method (native, sealed, sealed with encryption) and Hardware Attestation (attested or not attested).
• The Devices tab lists devices. The User Agents tab lists each distinct user-agent string with counts and a copy action.
• The list refreshes itself every 5, 15 or 30 seconds. Use Pause and Resume, or Refresh.
• Pick the page size from 25, 50 or 100 rows. Selections persist across pages and filter changes.
• Tick 2 to 4 rows and choose Compare, or choose Export to open Exports with your current filters filled in. Exports are described in Audit log and data export.

2. Read a device record

Select a row. The record opens at /fingerprints/<device id> with tabs:

Header actions include Copy ID, Compare, View journeys, View heatmap, View in Investigations (when enabled) and Open in…. When disputes are enabled for your workspace, the Overview tab offers Dispute Verdict to open a false-positive dispute; the dispute goes to the review workflow described in Risk actions, investigations and entity lookup. The sessions timeline says “One device only”: it does not merge identities.

3. Watch live traffic

Open Device Intelligence → Live Fingerprints. The page streams recent visits and submissions with a location map.

• KPI tiles: Active devices, Active now, Devices seen (history), Visits, Submissions, High / Critical.
• Filter the stream by risk level, pause and resume it, and choose a polling interval of 5, 15 or 30 seconds.
• Select a row to open the device record.
• The history panels can lag. The page states the lag: history up to the shown window, which “may lag up to ~15 min”. If the real-time read fails, the page says so and shows delayed history instead.

4. Compare devices

Select 2 to 4 rows on Fingerprints and choose Compare, or open /fingerprints/compare?ids=<a>,<b>. Tabs: Overview, Signals, Signal data, Environment, Raw. Differences are highlighted; flags are split into common and only-in-one-device. If a device ID exists in more than one workspace you can reach, pick the tenant for each slot.

5. Read population statistics

Open Fingerprint Population for fleet-wide distributions over a window of 24 hours, 7 days or 30 days, filtered by signal family. Buckets with too few devices are hidden before they reach the page, and hidden buckets are excluded from every total. The page never identifies an individual device and changes no detection behavior. Use a device’s Population tab to see where one device sits.

6. Review Related Devices (when enabled)

Related Devices lists candidate relations: two device IDs that share signals, with a confidence (High, Medium, Low), an ordinal score from 0 to 100 for ranking, the link types and the itemised evidence and counter-evidence. A relation expires. It never merges devices and never feeds a score or verdict. The page states that edge precision and 7-day re-link recall have not been evaluated, so treat each relation as a lead, not as proof that one operator controls both devices.

7. Use Risk Analytics and Dashboards

Risk Analytics has the tabs Trends, Distribution, Signals and Geography, a Time range, a Breakdown dimension (Country, City, Platform, ASN) and key figures: Total submissions, Critical rate, High risk and a device count. Use CSV buttons to download a chart’s data. Views → Save current view… stores the time range, filters and toggles as a preset that only you can see.

Dashboards has the tabs Dashboards, Cards and Cohorts. Build operator views from funnels, journeys, heat maps, web vitals, dimensions, retention and feature adoption. Viewers and Analysts read them. Creating or changing a dashboard, card or cohort needs the Admin role and a fresh MFA check.

8. Read Geo-risk and Hardware Attestation

• Geo-risk (Admin) has the tabs Country, ASN and IP block over 7, 30 or 90 days, with a map. Cells below the privacy floor are suppressed. Without the underlying rollup the page says “Not enabled yet”.
• Hardware Attestation (Admin) has Distribution, GPU detail and Mobile attestations. The mobile tab is a read-only ledger of Android and iOS attestation results for the workspace, with Play Integrity and App Attest verdicts shown as recorded. If too few records exist, the ledger hides individual rows. Register your apps under Integrations & API → Attestation Apps; see Device and app attestation.

9. Triage Issues

Issues groups runtime errors and deterministic behavior signals. The Errors and Behavior tabs take filters for severity, type, route, release and device. Severity is a deterministic impact rule: occurrences multiplied by affected users (1,000 or more is Critical, 100 or more High, 10 or more Medium, otherwise Low), with a High floor on checkout, payment and billing routes. It is not AI grading. Error capture is covered in Browser errors, console logs and source maps.

Verify it works

• A device you know sent traffic appears on Fingerprints after a search by its device ID, and its record opens with a score, a band and the Why this score breakdown.
• Live Fingerprints shows Streaming and your visit appears within one polling interval.
• On a comparison, selected devices show a difference count and highlighted rows.
• Risk Analytics → Trends shows non-zero Total submissions for the chosen range.
• If a page shows “not enabled”, “Rollup disabled” or an empty table, widen the range and confirm traffic exists before you conclude anything.

Troubleshooting

Related

• Backoffice guide: navigation, roles and shortcuts: roles and shortcuts, including G F, G L and G C.
• Risk actions, investigations and entity lookup: act on what you find.
• Detection signals: what each evidence layer contributes.
• Threat categories: public reason families and false-positive boundaries.
• Behavior analytics: heatmaps, journeys and funnels: the tracker pages.
• Audit log and data export: export fingerprints and events.