Detection and collection settings

The Detection & Collection group holds seven pages that change how Noxtica scores traffic and what the collector asks of a visitor’s browser. A workspace Admin changes them. This page says what each setting changes and gives an order for rolling a change out so that live traffic is never surprised.

What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

All seven pages are Admin pages in the sidebar. Every change is audited and asks for a fresh MFA check. Several settings have two keys: your switch, and a platform switch that Noxtica operations controls. Turning on your key does nothing visible until the platform key is also on, and a page says so next to the switch.

Several of these settings read personal data from visitors’ browsers. Noxtica provides the mechanism; the legal basis is yours. Link your decisions to Legal basis register and receipts and Cookies, storage and consent categories for your site.

Prerequisites

• The Admin role in the workspace. See Backoffice guide.
• An authenticator app for the step-up check.
• At least one domain with traffic, so shadow evidence can accumulate. See Domains, site keys and the install card.
• For behavioral capture, movement tracks, the extension probe, the location probe and persistent device recognition: counsel review and end-user consent where the law requires it. The page shows a warning next to each switch.

Steps

1. Plan the rollout order

Change one thing at a time and watch the evidence before the next change.

1. Collection cost first: Client Cost Levels and Collector change load, not decisions.
2. Collection additions next: Probes and Behavioral Signals, each with a recorded legal basis.
3. Scoring: Risk scoring weights and cutoffs, tested with Shadow candidates and Simulate & evidence before you save.
4. Enforcement: write Rules, set Enforcement mode to Shadow, read Risk actions, investigations and entity lookup, and only then consider Active.
5. Protection bands: move Verdict Bands from off to shadow, observe, then active.

2. Write rules and set the enforcement stage

Open Detection & Collection → Rules & Risk Scoring. The page has four tabs: Rules, Simulate & evidence, Risk scoring and Shadow candidates.

• Rules is an ordered list. Rules run by ascending priority, and the earliest matching rule picks the action. Actions are Allow, Challenge, Block and Tarpit. A rule can match on risk band, fired flags, agent verdict, URL path, device score, device properties, IP reputation or a flag prefix, and a per-rule challenge method (Invisible proof-of-work or Turnstile). A workspace can hold up to 100 rules.
• Enforcement mode has three stages. Off forwards every request. Shadow evaluates your rules and logs the would-be action without acting; this is the recommended first stage. Active acts on matches: block, challenge or tarpit. Changing the mode needs MFA, and switching to Active asks you to confirm.
• A rule acts only when the mode is Active and the rule’s own Shadow switch is off. Otherwise it observes. Each rule shows “Observing” or “Enforcing” with the reason.
• Selecting Active also depends on a platform enforcement switch that Noxtica operations controls. You can stage Active in advance, and it takes effect when that switch is on.
• Simulate & evidence dry-runs a rule against recent events and shows the daily fire mix, so you can size a rule before you arm it.
• Revisions & rollback publishes the live rule set as a numbered revision and can roll back to an older one. History is never rewritten.
• Domain-scoped rules are also available on a domain’s Risk rules tab and apply alongside tenant-wide rules.

3. Tune risk scoring

On the Risk scoring tab you can change the weight of each signal and the four cutoffs that map a score to a risk band. Cutoffs must stay strictly ordered: Critical above High above Medium above Low. A signal you turn off is ignored. High-confidence bot signals are marked Critical signal and only a platform superadmin can change or disable them. Estimate impact previews how a change would shift the band mix over recent traffic without applying it. Reset to defaults clears your overrides.

On the Shadow candidates tab, author alternative weightings. A candidate runs in a shadow pass, records a delta against the production verdict for the concordance view, and never changes a live verdict. Use Traffic impact to estimate flips. Accepting a change into production is a separate, deliberate step in Risk actions, investigations and entity lookup.

4. Set Client Cost Levels

Open Client Cost Levels, pick a domain, and choose Off, Light, Standard or High for each of three costs:

Standard is the default behavior. Higher levels detect more and ask more of every visitor’s device. The page suggests Light for checkout flows. The cost lands on the visitor’s device, so no level needs extra sign-off. Any effective replay rate below 100 percent records no anonymous web visitors.

5. Stage Verdict Bands and sealed results

Verdict Bands has two sections.

• Sealed Runtime security bands: Replay protection mode and Binding mode. Each moves Off → Shadow → Active. Off and shadow do not enforce. Active becomes selectable once a band is in shadow. In Active the replay band can block live submissions, subject to the platform enforcement switch. The binding band is signal-only in this iteration: Active does not block.
• Sealed results: turn on Emit sealed results and the submit response carries an encrypted envelope that only your backend can open. It restores the detailed flags withheld from the browser response. Your server fetches the key with a secret API key that carries the read:sealed_results scope, then opens the envelope. The console never shows the key. See the Server API overview.

6. Honeypots and shared intelligence

On Honeypots & Shared Intel, Enable honeypot tripwires arms decoy routes, decoy form fields and per-session canary tripwires. A tripped wire raises a risk signal for your rules and never blocks a visitor on its own. The page shows anonymous daily counts per tripwire (Hits (7d)). Rotate canary invalidates current per-session canaries and needs MFA. Detection stays inactive until the platform also arms honeypots for your workspace.

Federated intelligence has two independent switches: Contribute reports an anonymized, tenant-blinded marker when a cluster escalates; Consume lets scoring read a shared signal that exists only after several workspaces flagged the same cluster. Both default to off.

7. Set the Collector refresh interval

On Collector, Token refresh interval controls how often the script refreshes its session token. Options: 30 seconds, 1 minute, 5 minutes (default), 15 minutes, 1 hour, 6 hours, 24 hours, or Use plan default. Your plan sets a floor; a value below it is refused. Lower values are more responsive and cost more infrastructure. Effective shows the value in force. A single domain can override the interval on its detail page. New sessions use the new interval.

8. Toggle probes and behavioral signals

Probes has four sections. Each is a switch with a warning.

Behavioral Signals has three sections: Behavioral biometrics (mouse, click and scroll patterns for a per-domain behavioral subscore; disabled by default and classified as biometric data under the GDPR), Behavioral path tracks (a higher-risk category: pointer and touch path geometry; turning it off permanently deletes stored path records), and Behavioral flags (server-derived flags from session aggregates such as no interaction; default off, with a platform switch as the second key).

Verify it works

• After saving, the page shows a success message and the Last changed time.
• After you set a rule to shadow, the rule card reads “Observing (shadow)” and Would have fired counts grow with traffic.
• Effective on the Collector page shows the interval you chose.
• A verdict band set to Shadow shows no blocking; check Risk Actions for would-be decisions.
• Every change appears in the audit log.

Troubleshooting

Related

• Risk actions, investigations and entity lookup: read shadow evidence before you go Active.
• Domains, site keys and the install card: per-domain tracker policy and token refresh.
• Consent modes, GPC and Google Consent Mode: what the browser does without consent.
• Protected actions: client trigger and server check: protect login and checkout.
• Why calibration, not verdicts: map risk and confidence to your policy.
• Legal basis register and receipts: record the basis for optional collection.