Device Intelligence - GBG Documentation

Device Intelligence - Single Tenant - US

Capabilities

The module returns the following capabilities.

Threat device score

Device-modality threat — likelihood the device itself carries risk signals associated with known fraud.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Behavioral indicators

Behavioral Indicators

Code	Label	Description
`User Behavior Recognized`	User Behavior Recognized	User Behavior Recognized
`User Behavior Partially Recognized`	User Behavior Partially Recognized	User Behavior Partially Recognized
`User Behavior Not Recognized`	User Behavior Not Recognized	User Behavior Not Recognized
`Behavior Unknown`	Behavior Unknown	Behavior Unknown
`Not Available`	Not Available	Not Available - when none of the response above is available

Users seen on device

Users Seen on Device

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Threat BOT score

Likelihood the session is driven by a bot / non-human automation (e.g. headless browser, scripted actor).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Identity device score

Device-modality match — how strongly the device fingerprint matches the genuine user’s known device(s).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Days since user first seen

Days Since User First Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

IP address indicators

IP Address Indicators

Code	Label	Description
`Anonymizer Network Detected`	Anonymizer Network Detected	Anonymizer Network Detected
`Anonymous Hosting Network`	Anonymous Hosting Network	Anonymous Hosting Network
`Public Proxy`	Public Proxy	Public Proxy
`TOR Network`	TOR Network	TOR Network
`Anonymous Network`	Anonymous Network	Anonymous Network
`Anonymous VPN`	Anonymous VPN	Anonymous VPN
`Residential Proxy`	Residential Proxy	Residential Proxy
`Not Available`	Not Available	Not Available

Days since device last seen

Days Since Device Last Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Times user seen

Times User Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Devices seen on user

Devices Seen on User

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Threat keystrokes score

Keystroke-dynamics threat — likelihood the typing behaviour is anomalous / replayed rather than a genuine user.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Bot and RAT indicators

Bot and RAT Indicators

Code	Label	Description
`Bot Not Detected`	Bot Not Detected	Bot Not Detected
`Bot Detected`	Bot Detected	Bot Detected
`Headless Browser Detected`	Headless Browser Detected	Headless Browser Detected
`Open Port Detected`	Open Port Detected	Open Port Detected
`Probably Remote Access Tool Detected`	Probably Remote Access Tool Detected	Probably Remote Access Tool Detected
`Not Available`	Not Available	When none of the response above is available

Malware indicators

Malware Indicators

Code	Label	Description
`Page Not Modified`	Page Not Modified	Page Not Modified
`Page Modified`	Page Modified	Page Modified
`Page Modified After Page Load`	Page Modified After Page Load	Page Modified After Page Load
`Malware Status Unknown`	Malware Status Unknown	Malware Status Unknown
`Not Available`	Not Available	Not Available

Identity mouse score

Mouse-behaviour match — how closely the pointer dynamics match the user’s established baseline.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Threat RAT score

Likelihood a remote-access tool is controlling the session (remote takeover / scam-in-progress).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Days since user last seen

Days Since User Last Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Internet connection type

Internet Connection Type

Code	Label	Description
`Corporate`	Corporate	Corporate
`Cellular`	Cellular	Cellular
`Cable/DSL`	Cable/DSL	Cable/DSL
`Other`	Other	Other
`Not Available`	Not Available	Not Available

Threat location score

Location-modality threat — likelihood the location signals indicate risk (e.g. impossible travel, spoofing).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

IP address geo-Location

IP Address Geo-Location

Code	Label	Description
`IP Address Country Match`	IP Address Country Match	Codes are identical
`IP Address Country Mismatch`	IP Address Country Mismatch	Codes are not identical
`IP Address City Match`	IP Address City Match	Cities are identical
`IP Address City Mismatch`	IP Address City Mismatch	Cities are not identical
`IP Address Postcode Match`	IP Address Postcode Match	Postcodes are identical
`IP Address Postcode Mismatch`	IP Address Postcode Mismatch	Postcodes are not identical
`IP Region Match`	IP Region Match	Regions are identical
`IP Region Mismatch`	IP Region Mismatch	Regions are not identical
`IP Address Location Inconsistent`	IP Address Location Inconsistent	Distance (in meter) between the GO input address geocodes and the IP address geocode is more than the accuracy value
`IP Address Location Consistent`	IP Address Location Consistent	Distance (in meter) between the GO input address geocodes and the IP address geocode is less than the accuracy value
`Not Available`	Not Available	When none of the response is available
`No Result`	No Result	No Result

Device language

Device Language

Code	Label	Description
`en`	English	English
`pl`	Polski	Polski
`ro`	Română	Română
`es`	Español	Español
`it`	Italiano	Italiano
`tr`	Türkçe	Türkçe
`fr`	Français	Français
`de`	Deutsch	Deutsch
`pt`	Português	Português
`Other`	Other	Other
`Not Available`	Not Available	The language field is NULL or EMPTY

Location type

Location Type

Code	Label	Description
`business`	business	business
`cafe`	cafe	cafe
`cellular`	cellular	cellular
`college`	college	college
`consumer_privacy_network`	consumer_privacy_network	consumer_privacy_network
`consumer_delivery_network`	consumer_delivery_network	consumer_delivery_network
`government`	government	government
`hosting`	hosting	hosting
`library`	library	library
`military`	military	military
`residential`	residential	residential
`router`	router	router
`school`	school	school
`traveler`	traveler	traveler
`search_engine_spider`	search_engine_spider	search_engine_spider
`other`	other	In case a non-listed response value is provided by the Callsign API response (excluding NULL and EMPTY), the capability value will be set as other
`Not Available`	Not Available	In the case the response is NULL or EMPTY, the capability value will be set as Not Available

Threat score

Threat Score — an overall risk rating for the session, from 0 to 100. A higher score means stronger signs of fraud or automated/malicious activity (such as bots, remote-access tools, malware, or anonymised connections). Used to set the journey’s Risk Level: 80+ High Risk, 40–79 Medium Risk, below 40 Low / Very Low Risk.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Identity keystrokes score

Keystroke-dynamics match — how closely the typing rhythm matches the user’s established baseline.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Device indicators

Device Indicators

Code	Label	Description
`Device Recognized For User`	Device Recognized For User	Device Recognized For User
`Device Partially Recognized For User`	Device Partially Recognized For User	Device Partially Recognized For User
`Device Not Recognised For User`	Device Not Recognised For User	Device Not Recognised For User
`New Device For User`	New Device For User	New Device For User
`Private Browsing Detected`	Private Browsing Detected	Private Browsing Detected
`Screen Lock Set`	Screen Lock Set	Screen Lock Set
`Biometric Set`	Biometric Set	Biometric Set
`Pass Code Set`	Pass Code Set	Pass Code Set
`Jailbroken Device`	Jailbroken Device	Jailbroken Device
`SIM State Ready`	SIM State Ready	SIM State Ready
`SIM State Not Ready`	SIM State Not Ready	SIM State Not Ready
`SIM State PIN Required`	SIM State PIN Required	SIM State PIN Required
`SIM State Network Locked`	SIM State Network Locked	SIM State Network Locked
`SIM State Permanently Disabled`	SIM State Permanently Disabled	SIM State Permanently Disabled
`SIM State Absent`	SIM State Absent	SIM State Absent
`SIM State Unknown`	SIM State Unknown	SIM State Unknown
`SIM State Card IO Error`	SIM State Card IO Error	SIM State Card IO Error
`Not Available`	Not Available	Not Available

Device model error

Device Model Error

Detail	Description
Type	Boolean
Default	`false`

Time based indicators

Time Based Indicators

Code	Label	Description
`Time Based Behavior Recognised`	Time Based Behavior Recognised	Time Based Behavior Recognised
`Time Based Behavior Partially Recognised`	Time Based Behavior Partially Recognised	Time Based Behavior Partially Recognised
`Time Based Behavior Not Recognised`	Time Based Behavior Not Recognised	Time Based Behavior Not Recognised
`New Profile for Time Based Behavior`	New Profile for Time Based Behavior	New Profile for Time Based Behavior
`Suspicious Time Based Behavior`	Suspicious Time Based Behavior	Suspicious Time Based Behavior
`Not Available`	Not Available	Not Available

Times device seen

Times Device Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Compromise indicators

Compromise Indicators

Code	Label	Description
`No Replay Detected`	No Replay Detected	No Replay Detected
`Replay Detected`	Replay Detected	Replay Detected
`Keystrokes Replay Detected`	Keystrokes Replay Detected	Keystrokes Replay Detected
`Mouse Replay Detected`	Mouse Replay Detected	Mouse Replay Detected
`Debugger Connected`	Debugger Connected	Debugger Connected
`Device Unsecured`	Device Unsecured	Device Unsecured
`No Screen Lock`	No Screen Lock	No Screen Lock
`Data Integrity Check Failed`	Data Integrity Check Failed	Data Integrity Check Failed
`Device Hooked`	Device Hooked	Device Hooked
`Emulator Detected`	Emulator Detected	Emulator Detected
`Resources Modified`	Resources Modified	Resources Modified
`Swizzled`	Swizzled	Swizzled
`Tampering Detected`	Tampering Detected	Tampering Detected
`Collection Time Not Confirmed`	Collection Time Not Confirmed	Collection Time Not Confirmed
`Not Available`	Not Available	Not Available When none of the response above is available

Threat mouse score

Mouse-behaviour threat — likelihood the pointer dynamics are anomalous / automated.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Location indicators

Location Indicators

Code	Label	Description
`Location Recognized`	Location Recognized	Location Recognized
`Location Partially Recognized`	Location Partially Recognized	Location Partially Recognized
`Location Not Recognised`	Location Not Recognised	Location Not Recognised
`Suspicious Location Movement`	Suspicious Location Movement	Suspicious Location Movement
`Suspicious Location Source Mismatch`	Suspicious Location Source Mismatch	Suspicious Location Source Mismatch
`New Profile for Location`	New Profile for Location	New Profile for Location
`Not Available`	Not Available	Not Available - When none of the response above is available

Device OS

Code	Label	Description
`iOS`	iOS	iOS
`Android`	Android	Android
`Windows`	Windows	Windows
`macOS`	macOS	macOS
`Linux`	Linux	Linux
`Other`	Other	For other response & other non-NULL / non-Empty
`Not Available`	Not Available	Not Available if the mapped field value is NULL or EMPTY

Identity score

Ensembled (aggregate) identity score — overall likelihood the user is who they claim to be, across all identity modalities. Second-stage gate for Very Low / Low Risk.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Time zone offset

Time Zone Offset

Detail	Description
Type	Integer
Range	-720–720
Default	`0`

Identity location score

Location match — how consistent the location is with the user’s known mobility / location history.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Time zone region

Time Zone Region

Code	Label	Description
`Africa`	Africa	Africa
`America`	America	America
`Antarctica`	Antarctica	Antarctica
`Arctic`	Arctic	Arctic
`Asia`	Asia	Asia
`Atlantic`	Atlantic	Atlantic
`Australia`	Australia	Australia
`Europe`	Europe	Europe
`Indian`	Indian	Indian
`Pacific`	Pacific	Pacific
`Other`	Other	Other
`Not Available`	Not Available	The language field is NULL or EMPTY

Device type

Device Type

Code	Label	Description
`WEB`	WEB	WEB
`ANDROID`	ANDROID	ANDROID
`IOS`	IOS	IOS
`Not Available`	Not Available	Not Available

Device category

Device Category

Code	Label	Description
`desktop`	desktop	desktop
`tablet`	tablet	tablet
`smartphone`	smartphone	smartphone
`feature phone`	feature phone	feature phone
`Smart TV`	Smart TV	Smart TV
`robot`	robot	robot
`other non-mobile`	other non-mobile	other non-mobile
`other mobile`	other mobile	other mobile
`Other`	Other	When other non-NULL / non-Empty responses
`Not Available`	Not Available	If the mapped field value is NULL or EMPTY

Device language country

Device Language Country

Code	Label	Description
`GB`	United Kingdom	United Kingdom
`US`	United States	United States
`PL`	Poland	Poland
`AU`	Australia	Australia
`IN`	India	India
`IE`	Ireland	Ireland
`RO`	Romania	Romania
`CA`	Canada	Canada
`ZA`	South Africa	South Africa
`ES`	Spain	Spain
`Other`	Other	Other
`Not Available`	Not Available	If the language field is NULL or EMPTY

Threat indicators

Threat Indicators

Code	Label	Description
`Threat Not Detected`	Threat Not Detected	Threat Not Detected
`Threat Detected`	Threat Detected	Threat Detected
`Strong Biometric Risk Detected`	Strong Biometric Risk Detected	Strong Biometric Risk Detected
`Biometric Risk Detected`	Biometric Risk Detected	Biometric Risk Detected
`Device Risk Detected`	Device Risk Detected	Device Risk Detected
`Location Risk Detected`	Location Risk Detected	Location Risk Detected
`Not Available`	Not Available	Not Available

Keystrokes and mouse behavior

Keystrokes and Mouse Behavior

Code	Label	Description
`Keystrokes Recognized`	Keystrokes Recognized	Keystrokes Recognized
`Keystrokes Partially Recognized`	Keystrokes Partially Recognized	Keystrokes Partially Recognized
`Keystrokes Not Recognized`	Keystrokes Not Recognized	Keystrokes Not Recognized
`New Profile for Keystrokes`	New Profile for Keystrokes	New Profile for Keystrokes
`Mouse Behavior Recognized`	Mouse Behavior Recognized	Mouse Behavior Recognized
`Mouse Behavior Partially Recognised`	Mouse Behavior Partially Recognised	Mouse Behavior Partially Recognised
`Mouse Behavior Not Recognized`	Mouse Behavior Not Recognized	Mouse Behavior Not Recognized
`New Profile for Mouse Behavior`	New Profile for Mouse Behavior	New Profile for Mouse Behavior
`Autofill Detected`	Autofill Detected	Autofill Detected
`Autologin Detected`	Autologin Detected	Autologin Detected
`Copy and Paste Detected`	Copy and Paste Detected	Copy and Paste Detected
`Password Manager Detected`	Password Manager Detected	Password Manager Detected
`Not Available`	Not Available	Not Available

Days since device first seen

Days Since Device First Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Default outcomes

The module is pre-configured with the following default outcomes, which can be used in evaluation and routing logic within the journey designer.

Outcome	Condition	Description
`Error`	—	[Describe.]
`High Risk`	Threat Score >= `80`	[Describe.]
`Medium Risk`	Threat Score < `80` and Threat Score >= `40`	[Describe.]
`Very Low Risk`	Identity Score >= `80` and Threat Score < `40` and Threat Score >= `0`	[Describe.]
`Low Risk`	Identity Score >= `0` and Threat Score < `40` and Threat Score >= `0`	[Describe.]
`Risk Level Not Calculated`	default, when no conditions matched	[Describe.]

Input payload

The following is a sample payload used to submit data to the Device Intelligence - Single Tenant - US module for processing.

JSON

{
  "context": {
    "subject": {
      "uid": "variant-test-user",
      "sessions": [
        {
          "type": "deviceCheck",
          "id": "sid-6018d1ce-f5cc-489e-a901-f069d2ce19ba",
          "transaction": {
            "id": "txn-617f2bd4-f18d-43b8-af15-514bb835466f"
          },
          "user": {
            "id": "error-user"
          }
        }
      ],
      "identity": {
        "firstName": "Error",
        "lastNames": [
          "Error"
        ],
        "dateOfBirth": "1999-09-09",
        "currentAddress": {
          "premise": "999",
          "thoroughfare": "The Street",
          "locality": "Anyton",
          "postalCode": "AA9 9AA",
          "country": "US"
        },
        "phones": [
          {
            "type": "mobile",
            "number": "+44770000999"
          }
        ]
      },
      "accounts": [
        {
          "type": "Bank Account",
          "accountNumber": "11111999",
          "sortCode": "99-99-99"
        }
      ]
    }
  }
}

Field	Required	Description
`CurrentAddress`	No	[Describe.]
`CurrentAddress/lines`	No	[Describe.]
`CurrentAddress/addressString`	No	[Describe.]
`CurrentAddress/premise`	No	[Describe.]
`CurrentAddress/building`	No	[Describe.]
`CurrentAddress/subBuilding`	No	[Describe.]
`CurrentAddress/thoroughfare`	No	[Describe.]
`CurrentAddress/dependentThoroughfare`	No	[Describe.]
`CurrentAddress/locality`	No	[Describe.]
`CurrentAddress/dependentLocality`	No	[Describe.]
`CurrentAddress/doubleDependentLocality`	No	[Describe.]
`CurrentAddress/postalCode`	No	[Describe.]
`CurrentAddress/postBox`	No	[Describe.]
`CurrentAddress/country`	Yes	[Describe.]
`CurrentAddress/superAdministrativeArea`	No	[Describe.]
`CurrentAddress/administrativeArea`	No	[Describe.]
`CurrentAddress/subAdministrativeArea`	No	[Describe.]
`CurrentAddress/organization`	No	[Describe.]
`CurrentAddress/location`	No	[Describe.]
`DeviceCheck`	Yes	[Describe.]

Sample response

The following is a sample response returned by the module.

JSON

{
  "response": {
    "outcome": "Error",
    "advice": {}
  }
}

Device Intelligence - Single Tenant - AU

Capabilities

The module returns the following capabilities.

Threat device score

Device-modality threat — likelihood the device itself carries risk signals associated with known fraud.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Behavioral indicators

Behavioral Indicators

Code	Label	Description
`User Behavior Recognized`	User Behavior Recognized	User Behavior Recognized
`User Behavior Partially Recognized`	User Behavior Partially Recognized	User Behavior Partially Recognized
`User Behavior Not Recognized`	User Behavior Not Recognized	User Behavior Not Recognized
`Behavior Unknown`	Behavior Unknown	Behavior Unknown
`Not Available`	Not Available	Not Available - when none of the response above is available

Users seen on device

Users Seen on Device

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Threat BOT score

Likelihood the session is driven by a bot / non-human automation (e.g. headless browser, scripted actor).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Identity device score

Device-modality match — how strongly the device fingerprint matches the genuine user’s known device(s).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Days since user first seen

Days Since User First Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

IP address indicators

IP Address Indicators

Code	Label	Description
`Anonymizer Network Detected`	Anonymizer Network Detected	Anonymizer Network Detected
`Anonymous Hosting Network`	Anonymous Hosting Network	Anonymous Hosting Network
`Public Proxy`	Public Proxy	Public Proxy
`TOR Network`	TOR Network	TOR Network
`Anonymous Network`	Anonymous Network	Anonymous Network
`Anonymous VPN`	Anonymous VPN	Anonymous VPN
`Residential Proxy`	Residential Proxy	Residential Proxy
`Not Available`	Not Available	Not Available

Days since device last seen

Days Since Device Last Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Times user seen

Times User Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Devices seen on user

Devices Seen on User

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Threat keystrokes score

Keystroke-dynamics threat — likelihood the typing behaviour is anomalous / replayed rather than a genuine user.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Bot and RAT indicators

Bot and RAT Indicators

Code	Label	Description
`Bot Not Detected`	Bot Not Detected	Bot Not Detected
`Bot Detected`	Bot Detected	Bot Detected
`Headless Browser Detected`	Headless Browser Detected	Headless Browser Detected
`Open Port Detected`	Open Port Detected	Open Port Detected
`Probably Remote Access Tool Detected`	Probably Remote Access Tool Detected	Probably Remote Access Tool Detected
`Not Available`	Not Available	When none of the response above is available

Malware indicators

Malware Indicators

Code	Label	Description
`Page Not Modified`	Page Not Modified	Page Not Modified
`Page Modified`	Page Modified	Page Modified
`Page Modified After Page Load`	Page Modified After Page Load	Page Modified After Page Load
`Malware Status Unknown`	Malware Status Unknown	Malware Status Unknown
`Not Available`	Not Available	Not Available

Identity mouse score

Mouse-behaviour match — how closely the pointer dynamics match the user’s established baseline.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Threat RAT score

Likelihood a remote-access tool is controlling the session (remote takeover / scam-in-progress).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Days since user last seen

Days Since User Last Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Internet connection type

Internet Connection Type

Code	Label	Description
`Corporate`	Corporate	Corporate
`Cellular`	Cellular	Cellular
`Cable/DSL`	Cable/DSL	Cable/DSL
`Other`	Other	Other
`Not Available`	Not Available	Not Available

Threat location score

Location-modality threat — likelihood the location signals indicate risk (e.g. impossible travel, spoofing).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

IP address geo-Location

IP Address Geo-Location

Code	Label	Description
`IP Address Country Match`	IP Address Country Match	Codes are identical
`IP Address Country Mismatch`	IP Address Country Mismatch	Codes are not identical
`IP Address City Match`	IP Address City Match	Cities are identical
`IP Address City Mismatch`	IP Address City Mismatch	Cities are not identical
`IP Address Postcode Match`	IP Address Postcode Match	Postcodes are identical
`IP Address Postcode Mismatch`	IP Address Postcode Mismatch	Postcodes are not identical
`IP Region Match`	IP Region Match	Regions are identical
`IP Region Mismatch`	IP Region Mismatch	Regions are not identical
`IP Address Location Inconsistent`	IP Address Location Inconsistent	Distance (in meter) between the GO input address geocodes and the IP address geocode is more than the accuracy value
`IP Address Location Consistent`	IP Address Location Consistent	Distance (in meter) between the GO input address geocodes and the IP address geocode is less than the accuracy value
`Not Available`	Not Available	When none of the response is available
`No Result`	No Result	No Result

Device language

Device Language

Code	Label	Description
`en`	English	English
`pl`	Polski	Polski
`ro`	Română	Română
`es`	Español	Español
`it`	Italiano	Italiano
`tr`	Türkçe	Türkçe
`fr`	Français	Français
`de`	Deutsch	Deutsch
`pt`	Português	Português
`Other`	Other	Other
`Not Available`	Not Available	The language field is NULL or EMPTY

Location type

Location Type

Code	Label	Description
`business`	business	business
`cafe`	cafe	cafe
`cellular`	cellular	cellular
`college`	college	college
`consumer_privacy_network`	consumer_privacy_network	consumer_privacy_network
`consumer_delivery_network`	consumer_delivery_network	consumer_delivery_network
`government`	government	government
`hosting`	hosting	hosting
`library`	library	library
`military`	military	military
`residential`	residential	residential
`router`	router	router
`school`	school	school
`traveler`	traveler	traveler
`search_engine_spider`	search_engine_spider	search_engine_spider
`other`	other	In case a non-listed response value is provided by the Callsign API response (excluding NULL and EMPTY), the capability value will be set as other
`Not Available`	Not Available	In the case the response is NULL or EMPTY, the capability value will be set as Not Available

Threat score

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Identity keystrokes score

Keystroke-dynamics match — how closely the typing rhythm matches the user’s established baseline.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Device indicators

Device Indicators

Code	Label	Description
`Device Recognized For User`	Device Recognized For User	Device Recognized For User
`Device Partially Recognized For User`	Device Partially Recognized For User	Device Partially Recognized For User
`Device Not Recognised For User`	Device Not Recognised For User	Device Not Recognised For User
`New Device For User`	New Device For User	New Device For User
`Private Browsing Detected`	Private Browsing Detected	Private Browsing Detected
`Screen Lock Set`	Screen Lock Set	Screen Lock Set
`Biometric Set`	Biometric Set	Biometric Set
`Pass Code Set`	Pass Code Set	Pass Code Set
`Jailbroken Device`	Jailbroken Device	Jailbroken Device
`SIM State Ready`	SIM State Ready	SIM State Ready
`SIM State Not Ready`	SIM State Not Ready	SIM State Not Ready
`SIM State PIN Required`	SIM State PIN Required	SIM State PIN Required
`SIM State Network Locked`	SIM State Network Locked	SIM State Network Locked
`SIM State Permanently Disabled`	SIM State Permanently Disabled	SIM State Permanently Disabled
`SIM State Absent`	SIM State Absent	SIM State Absent
`SIM State Unknown`	SIM State Unknown	SIM State Unknown
`SIM State Card IO Error`	SIM State Card IO Error	SIM State Card IO Error
`Not Available`	Not Available	Not Available

Device model error

Device Model Error

Detail	Description
Type	Boolean
Default	`false`

Time based indicators

Time Based Indicators

Code	Label	Description
`Time Based Behavior Recognised`	Time Based Behavior Recognised	Time Based Behavior Recognised
`Time Based Behavior Partially Recognised`	Time Based Behavior Partially Recognised	Time Based Behavior Partially Recognised
`Time Based Behavior Not Recognised`	Time Based Behavior Not Recognised	Time Based Behavior Not Recognised
`New Profile for Time Based Behavior`	New Profile for Time Based Behavior	New Profile for Time Based Behavior
`Suspicious Time Based Behavior`	Suspicious Time Based Behavior	Suspicious Time Based Behavior
`Not Available`	Not Available	Not Available

Times device seen

Times Device Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Compromise indicators

Compromise Indicators

Code	Label	Description
`No Replay Detected`	No Replay Detected	No Replay Detected
`Replay Detected`	Replay Detected	Replay Detected
`Keystrokes Replay Detected`	Keystrokes Replay Detected	Keystrokes Replay Detected
`Mouse Replay Detected`	Mouse Replay Detected	Mouse Replay Detected
`Debugger Connected`	Debugger Connected	Debugger Connected
`Device Unsecured`	Device Unsecured	Device Unsecured
`No Screen Lock`	No Screen Lock	No Screen Lock
`Data Integrity Check Failed`	Data Integrity Check Failed	Data Integrity Check Failed
`Device Hooked`	Device Hooked	Device Hooked
`Emulator Detected`	Emulator Detected	Emulator Detected
`Resources Modified`	Resources Modified	Resources Modified
`Swizzled`	Swizzled	Swizzled
`Tampering Detected`	Tampering Detected	Tampering Detected
`Collection Time Not Confirmed`	Collection Time Not Confirmed	Collection Time Not Confirmed
`Not Available`	Not Available	Not Available When none of the response above is available

Threat mouse score

Mouse-behaviour threat — likelihood the pointer dynamics are anomalous / automated.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Location indicators

Location Indicators

Code	Label	Description
`Location Recognized`	Location Recognized	Location Recognized
`Location Partially Recognized`	Location Partially Recognized	Location Partially Recognized
`Location Not Recognised`	Location Not Recognised	Location Not Recognised
`Suspicious Location Movement`	Suspicious Location Movement	Suspicious Location Movement
`Suspicious Location Source Mismatch`	Suspicious Location Source Mismatch	Suspicious Location Source Mismatch
`New Profile for Location`	New Profile for Location	New Profile for Location
`Not Available`	Not Available	Not Available - When none of the response above is available

Device OS

Code	Label	Description
`iOS`	iOS	iOS
`Android`	Android	Android
`Windows`	Windows	Windows
`macOS`	macOS	macOS
`Linux`	Linux	Linux
`Other`	Other	For other response & other non-NULL / non-Empty
`Not Available`	Not Available	Not Available if the mapped field value is NULL or EMPTY

Identity score

Ensembled (aggregate) identity score — overall likelihood the user is who they claim to be, across all identity modalities. Second-stage gate for Very Low / Low Risk.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Time zone offset

Time Zone Offset

Detail	Description
Type	Integer
Range	-720–720
Default	`0`

Identity location score

Location match — how consistent the location is with the user’s known mobility / location history.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Time zone region

Time Zone Region

Code	Label	Description
`Africa`	Africa	Africa
`America`	America	America
`Antarctica`	Antarctica	Antarctica
`Arctic`	Arctic	Arctic
`Asia`	Asia	Asia
`Atlantic`	Atlantic	Atlantic
`Australia`	Australia	Australia
`Europe`	Europe	Europe
`Indian`	Indian	Indian
`Pacific`	Pacific	Pacific
`Other`	Other	Other
`Not Available`	Not Available	The language field is NULL or EMPTY

Device type

Device Type

Code	Label	Description
`WEB`	WEB	WEB
`ANDROID`	ANDROID	ANDROID
`IOS`	IOS	IOS
`Not Available`	Not Available	Not Available

Device category

Device Category

Code	Label	Description
`desktop`	desktop	desktop
`tablet`	tablet	tablet
`smartphone`	smartphone	smartphone
`feature phone`	feature phone	feature phone
`Smart TV`	Smart TV	Smart TV
`robot`	robot	robot
`other non-mobile`	other non-mobile	other non-mobile
`other mobile`	other mobile	other mobile
`Other`	Other	When other non-NULL / non-Empty responses
`Not Available`	Not Available	If the mapped field value is NULL or EMPTY

Device language country

Device Language Country

Code	Label	Description
`GB`	United Kingdom	United Kingdom
`US`	United States	United States
`PL`	Poland	Poland
`AU`	Australia	Australia
`IN`	India	India
`IE`	Ireland	Ireland
`RO`	Romania	Romania
`CA`	Canada	Canada
`ZA`	South Africa	South Africa
`ES`	Spain	Spain
`Other`	Other	Other
`Not Available`	Not Available	If the language field is NULL or EMPTY

Threat indicators

Threat Indicators

Code	Label	Description
`Threat Not Detected`	Threat Not Detected	Threat Not Detected
`Threat Detected`	Threat Detected	Threat Detected
`Strong Biometric Risk Detected`	Strong Biometric Risk Detected	Strong Biometric Risk Detected
`Biometric Risk Detected`	Biometric Risk Detected	Biometric Risk Detected
`Device Risk Detected`	Device Risk Detected	Device Risk Detected
`Location Risk Detected`	Location Risk Detected	Location Risk Detected
`Not Available`	Not Available	Not Available

Keystrokes and mouse behavior

Keystrokes and Mouse Behavior

Code	Label	Description
`Keystrokes Recognized`	Keystrokes Recognized	Keystrokes Recognized
`Keystrokes Partially Recognized`	Keystrokes Partially Recognized	Keystrokes Partially Recognized
`Keystrokes Not Recognized`	Keystrokes Not Recognized	Keystrokes Not Recognized
`New Profile for Keystrokes`	New Profile for Keystrokes	New Profile for Keystrokes
`Mouse Behavior Recognized`	Mouse Behavior Recognized	Mouse Behavior Recognized
`Mouse Behavior Partially Recognised`	Mouse Behavior Partially Recognised	Mouse Behavior Partially Recognised
`Mouse Behavior Not Recognized`	Mouse Behavior Not Recognized	Mouse Behavior Not Recognized
`New Profile for Mouse Behavior`	New Profile for Mouse Behavior	New Profile for Mouse Behavior
`Autofill Detected`	Autofill Detected	Autofill Detected
`Autologin Detected`	Autologin Detected	Autologin Detected
`Copy and Paste Detected`	Copy and Paste Detected	Copy and Paste Detected
`Password Manager Detected`	Password Manager Detected	Password Manager Detected
`Not Available`	Not Available	Not Available

Days since device first seen

Days Since Device First Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Default outcomes

The module is pre-configured with the following default outcomes, which can be used in evaluation and routing logic within the journey designer.

Outcome	Condition	Description
`High Risk`	Threat Score >= `80`	[Describe.]
`Error`	—	[Describe.]
`Medium Risk`	Threat Score < `80` and Threat Score >= `40`	[Describe.]
`Very Low Risk`	Identity Score >= `80` and Threat Score < `40` and Threat Score >= `0`	[Describe.]
`Low Risk`	Identity Score >= `0` and Threat Score < `40` and Threat Score >= `0`	[Describe.]
`Risk Level Not Calculated`	default, when no conditions matched	[Describe.]

Input payload

The following is a sample payload used to submit data to the Device Intelligence - Single Tenant - AU module for processing.

JSON

{
  "context": {
    "subject": {
      "uid": "variant-test-user",
      "sessions": [
        {
          "type": "deviceCheck",
          "id": "sid-6018d1ce-f5cc-489e-a901-f069d2ce19ba",
          "transaction": {
            "id": "txn-617f2bd4-f18d-43b8-af15-514bb835466f"
          },
          "user": {
            "id": "error-user"
          }
        }
      ],
      "identity": {
        "firstName": "Error",
        "lastNames": [
          "Error"
        ],
        "dateOfBirth": "1999-09-09",
        "currentAddress": {
          "premise": "999",
          "thoroughfare": "The Street",
          "locality": "Anyton",
          "postalCode": "AA9 9AA",
          "country": "US"
        },
        "phones": [
          {
            "type": "mobile",
            "number": "+44770000999"
          }
        ]
      },
      "accounts": [
        {
          "type": "Bank Account",
          "accountNumber": "11111999",
          "sortCode": "99-99-99"
        }
      ]
    }
  }
}

Field	Required	Description
`CurrentAddress`	No	[Describe.]
`CurrentAddress/lines`	No	[Describe.]
`CurrentAddress/addressString`	No	[Describe.]
`CurrentAddress/premise`	No	[Describe.]
`CurrentAddress/building`	No	[Describe.]
`CurrentAddress/subBuilding`	No	[Describe.]
`CurrentAddress/thoroughfare`	No	[Describe.]
`CurrentAddress/dependentThoroughfare`	No	[Describe.]
`CurrentAddress/locality`	No	[Describe.]
`CurrentAddress/dependentLocality`	No	[Describe.]
`CurrentAddress/doubleDependentLocality`	No	[Describe.]
`CurrentAddress/postalCode`	No	[Describe.]
`CurrentAddress/postBox`	No	[Describe.]
`CurrentAddress/country`	Yes	[Describe.]
`CurrentAddress/superAdministrativeArea`	No	[Describe.]
`CurrentAddress/administrativeArea`	No	[Describe.]
`CurrentAddress/subAdministrativeArea`	No	[Describe.]
`CurrentAddress/organization`	No	[Describe.]
`CurrentAddress/location`	No	[Describe.]
`DeviceCheck`	Yes	[Describe.]

Sample response

The following is a sample response returned by the module.

JSON

{
  "response": {
    "outcome": "Error",
    "advice": {}
  }
}

Device Intelligence - Single Tenant - EU

Capabilities

The module returns the following capabilities.

Threat device score

Device-modality threat — likelihood the device itself carries risk signals associated with known fraud.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Behavioral indicators

Behavioral Indicators

Code	Label	Description
`User Behavior Recognized`	User Behavior Recognized	User Behavior Recognized
`User Behavior Partially Recognized`	User Behavior Partially Recognized	User Behavior Partially Recognized
`User Behavior Not Recognized`	User Behavior Not Recognized	User Behavior Not Recognized
`Behavior Unknown`	Behavior Unknown	Behavior Unknown
`Not Available`	Not Available	Not Available - when none of the response above is available

Users seen on device

Users Seen on Device

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Threat BOT score

Likelihood the session is driven by a bot / non-human automation (e.g. headless browser, scripted actor).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Identity device score

Device-modality match — how strongly the device fingerprint matches the genuine user’s known device(s).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Days since user first seen

Days Since User First Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

IP address indicators

IP Address Indicators

Code	Label	Description
`Anonymizer Network Detected`	Anonymizer Network Detected	Anonymizer Network Detected
`Anonymous Hosting Network`	Anonymous Hosting Network	Anonymous Hosting Network
`Public Proxy`	Public Proxy	Public Proxy
`TOR Network`	TOR Network	TOR Network
`Anonymous Network`	Anonymous Network	Anonymous Network
`Anonymous VPN`	Anonymous VPN	Anonymous VPN
`Residential Proxy`	Residential Proxy	Residential Proxy
`Not Available`	Not Available	Not Available

Days since device last seen

Days Since Device Last Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Times user seen

Times User Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Devices seen on user

Devices Seen on User

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Threat keystrokes score

Keystroke-dynamics threat — likelihood the typing behaviour is anomalous / replayed rather than a genuine user.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Bot and RAT indicators

Bot and RAT Indicators

Code	Label	Description
`Bot Not Detected`	Bot Not Detected	Bot Not Detected
`Bot Detected`	Bot Detected	Bot Detected
`Headless Browser Detected`	Headless Browser Detected	Headless Browser Detected
`Open Port Detected`	Open Port Detected	Open Port Detected
`Probably Remote Access Tool Detected`	Probably Remote Access Tool Detected	Probably Remote Access Tool Detected
`Not Available`	Not Available	When none of the response above is available

Malware indicators

Malware Indicators

Code	Label	Description
`Page Not Modified`	Page Not Modified	Page Not Modified
`Page Modified`	Page Modified	Page Modified
`Page Modified After Page Load`	Page Modified After Page Load	Page Modified After Page Load
`Malware Status Unknown`	Malware Status Unknown	Malware Status Unknown
`Not Available`	Not Available	Not Available

Identity mouse score

Mouse-behaviour match — how closely the pointer dynamics match the user’s established baseline.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Threat RAT score

Likelihood a remote-access tool is controlling the session (remote takeover / scam-in-progress).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Days since user last seen

Days Since User Last Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Internet connection type

Internet Connection Type

Code	Label	Description
`Corporate`	Corporate	Corporate
`Cellular`	Cellular	Cellular
`Cable/DSL`	Cable/DSL	Cable/DSL
`Other`	Other	Other
`Not Available`	Not Available	Not Available

Threat location score

Location-modality threat — likelihood the location signals indicate risk (e.g. impossible travel, spoofing).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

IP address geo-Location

IP Address Geo-Location

Code	Label	Description
`IP Address Country Match`	IP Address Country Match	Codes are identical
`IP Address Country Mismatch`	IP Address Country Mismatch	Codes are not identical
`IP Address City Match`	IP Address City Match	Cities are identical
`IP Address City Mismatch`	IP Address City Mismatch	Cities are not identical
`IP Address Postcode Match`	IP Address Postcode Match	Postcodes are identical
`IP Address Postcode Mismatch`	IP Address Postcode Mismatch	Postcodes are not identical
`IP Region Match`	IP Region Match	Regions are identical
`IP Region Mismatch`	IP Region Mismatch	Regions are not identical
`IP Address Location Inconsistent`	IP Address Location Inconsistent	Distance (in meter) between the GO input address geocodes and the IP address geocode is more than the accuracy value
`IP Address Location Consistent`	IP Address Location Consistent	Distance (in meter) between the GO input address geocodes and the IP address geocode is less than the accuracy value
`Not Available`	Not Available	When none of the response is available
`No Result`	No Result	No Result

Device language

Device Language

Code	Label	Description
`en`	English	English
`pl`	Polski	Polski
`ro`	Română	Română
`es`	Español	Español
`it`	Italiano	Italiano
`tr`	Türkçe	Türkçe
`fr`	Français	Français
`de`	Deutsch	Deutsch
`pt`	Português	Português
`Other`	Other	Other
`Not Available`	Not Available	The language field is NULL or EMPTY

Location type

Location Type

Code	Label	Description
`business`	business	business
`cafe`	cafe	cafe
`cellular`	cellular	cellular
`college`	college	college
`consumer_privacy_network`	consumer_privacy_network	consumer_privacy_network
`consumer_delivery_network`	consumer_delivery_network	consumer_delivery_network
`government`	government	government
`hosting`	hosting	hosting
`library`	library	library
`military`	military	military
`residential`	residential	residential
`router`	router	router
`school`	school	school
`traveler`	traveler	traveler
`search_engine_spider`	search_engine_spider	search_engine_spider
`other`	other	In case a non-listed response value is provided by the Callsign API response (excluding NULL and EMPTY), the capability value will be set as other
`Not Available`	Not Available	In the case the response is NULL or EMPTY, the capability value will be set as Not Available

Threat score

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Identity keystrokes score

Keystroke-dynamics match — how closely the typing rhythm matches the user’s established baseline.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Device indicators

Device Indicators

Code	Label	Description
`Device Recognized For User`	Device Recognized For User	Device Recognized For User
`Device Partially Recognized For User`	Device Partially Recognized For User	Device Partially Recognized For User
`Device Not Recognised For User`	Device Not Recognised For User	Device Not Recognised For User
`New Device For User`	New Device For User	New Device For User
`Private Browsing Detected`	Private Browsing Detected	Private Browsing Detected
`Screen Lock Set`	Screen Lock Set	Screen Lock Set
`Biometric Set`	Biometric Set	Biometric Set
`Pass Code Set`	Pass Code Set	Pass Code Set
`Jailbroken Device`	Jailbroken Device	Jailbroken Device
`SIM State Ready`	SIM State Ready	SIM State Ready
`SIM State Not Ready`	SIM State Not Ready	SIM State Not Ready
`SIM State PIN Required`	SIM State PIN Required	SIM State PIN Required
`SIM State Network Locked`	SIM State Network Locked	SIM State Network Locked
`SIM State Permanently Disabled`	SIM State Permanently Disabled	SIM State Permanently Disabled
`SIM State Absent`	SIM State Absent	SIM State Absent
`SIM State Unknown`	SIM State Unknown	SIM State Unknown
`SIM State Card IO Error`	SIM State Card IO Error	SIM State Card IO Error
`Not Available`	Not Available	Not Available

Device model error

Device Model Error

Detail	Description
Type	Boolean
Default	`false`

Time based indicators

Time Based Indicators

Code	Label	Description
`Time Based Behavior Recognised`	Time Based Behavior Recognised	Time Based Behavior Recognised
`Time Based Behavior Partially Recognised`	Time Based Behavior Partially Recognised	Time Based Behavior Partially Recognised
`Time Based Behavior Not Recognised`	Time Based Behavior Not Recognised	Time Based Behavior Not Recognised
`New Profile for Time Based Behavior`	New Profile for Time Based Behavior	New Profile for Time Based Behavior
`Suspicious Time Based Behavior`	Suspicious Time Based Behavior	Suspicious Time Based Behavior
`Not Available`	Not Available	Not Available

Times device seen

Times Device Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Compromise indicators

Compromise Indicators

Code	Label	Description
`No Replay Detected`	No Replay Detected	No Replay Detected
`Replay Detected`	Replay Detected	Replay Detected
`Keystrokes Replay Detected`	Keystrokes Replay Detected	Keystrokes Replay Detected
`Mouse Replay Detected`	Mouse Replay Detected	Mouse Replay Detected
`Debugger Connected`	Debugger Connected	Debugger Connected
`Device Unsecured`	Device Unsecured	Device Unsecured
`No Screen Lock`	No Screen Lock	No Screen Lock
`Data Integrity Check Failed`	Data Integrity Check Failed	Data Integrity Check Failed
`Device Hooked`	Device Hooked	Device Hooked
`Emulator Detected`	Emulator Detected	Emulator Detected
`Resources Modified`	Resources Modified	Resources Modified
`Swizzled`	Swizzled	Swizzled
`Tampering Detected`	Tampering Detected	Tampering Detected
`Collection Time Not Confirmed`	Collection Time Not Confirmed	Collection Time Not Confirmed
`Not Available`	Not Available	Not Available When none of the response above is available

Threat mouse score

Mouse-behaviour threat — likelihood the pointer dynamics are anomalous / automated.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Location indicators

Location Indicators

Code	Label	Description
`Location Recognized`	Location Recognized	Location Recognized
`Location Partially Recognized`	Location Partially Recognized	Location Partially Recognized
`Location Not Recognised`	Location Not Recognised	Location Not Recognised
`Suspicious Location Movement`	Suspicious Location Movement	Suspicious Location Movement
`Suspicious Location Source Mismatch`	Suspicious Location Source Mismatch	Suspicious Location Source Mismatch
`New Profile for Location`	New Profile for Location	New Profile for Location
`Not Available`	Not Available	Not Available - When none of the response above is available

Device OS

Code	Label	Description
`iOS`	iOS	iOS
`Android`	Android	Android
`Windows`	Windows	Windows
`macOS`	macOS	macOS
`Linux`	Linux	Linux
`Other`	Other	For other response & other non-NULL / non-Empty
`Not Available`	Not Available	Not Available if the mapped field value is NULL or EMPTY

Identity score

Ensembled (aggregate) identity score — overall likelihood the user is who they claim to be, across all identity modalities. Second-stage gate for Very Low / Low Risk.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Time zone offset

Time Zone Offset

Detail	Description
Type	Integer
Range	-720–720
Default	`0`

Identity location score

Location match — how consistent the location is with the user’s known mobility / location history.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Time zone region

Time Zone Region

Code	Label	Description
`Africa`	Africa	Africa
`America`	America	America
`Antarctica`	Antarctica	Antarctica
`Arctic`	Arctic	Arctic
`Asia`	Asia	Asia
`Atlantic`	Atlantic	Atlantic
`Australia`	Australia	Australia
`Europe`	Europe	Europe
`Indian`	Indian	Indian
`Pacific`	Pacific	Pacific
`Other`	Other	Other
`Not Available`	Not Available	The language field is NULL or EMPTY

Device type

Device Type

Code	Label	Description
`WEB`	WEB	WEB
`ANDROID`	ANDROID	ANDROID
`IOS`	IOS	IOS
`Not Available`	Not Available	Not Available

Device category

Device Category

Code	Label	Description
`desktop`	desktop	desktop
`tablet`	tablet	tablet
`smartphone`	smartphone	smartphone
`feature phone`	feature phone	feature phone
`Smart TV`	Smart TV	Smart TV
`robot`	robot	robot
`other non-mobile`	other non-mobile	other non-mobile
`other mobile`	other mobile	other mobile
`Other`	Other	When other non-NULL / non-Empty responses
`Not Available`	Not Available	If the mapped field value is NULL or EMPTY

Device language country

Device Language Country

Code	Label	Description
`GB`	United Kingdom	United Kingdom
`US`	United States	United States
`PL`	Poland	Poland
`AU`	Australia	Australia
`IN`	India	India
`IE`	Ireland	Ireland
`RO`	Romania	Romania
`CA`	Canada	Canada
`ZA`	South Africa	South Africa
`ES`	Spain	Spain
`Other`	Other	Other
`Not Available`	Not Available	If the language field is NULL or EMPTY

Threat indicators

Threat Indicators

Code	Label	Description
`Threat Not Detected`	Threat Not Detected	Threat Not Detected
`Threat Detected`	Threat Detected	Threat Detected
`Strong Biometric Risk Detected`	Strong Biometric Risk Detected	Strong Biometric Risk Detected
`Biometric Risk Detected`	Biometric Risk Detected	Biometric Risk Detected
`Device Risk Detected`	Device Risk Detected	Device Risk Detected
`Location Risk Detected`	Location Risk Detected	Location Risk Detected
`Not Available`	Not Available	Not Available

Keystrokes and mouse behavior

Keystrokes and Mouse Behavior

Code	Label	Description
`Keystrokes Recognized`	Keystrokes Recognized	Keystrokes Recognized
`Keystrokes Partially Recognized`	Keystrokes Partially Recognized	Keystrokes Partially Recognized
`Keystrokes Not Recognized`	Keystrokes Not Recognized	Keystrokes Not Recognized
`New Profile for Keystrokes`	New Profile for Keystrokes	New Profile for Keystrokes
`Mouse Behavior Recognized`	Mouse Behavior Recognized	Mouse Behavior Recognized
`Mouse Behavior Partially Recognised`	Mouse Behavior Partially Recognised	Mouse Behavior Partially Recognised
`Mouse Behavior Not Recognized`	Mouse Behavior Not Recognized	Mouse Behavior Not Recognized
`New Profile for Mouse Behavior`	New Profile for Mouse Behavior	New Profile for Mouse Behavior
`Autofill Detected`	Autofill Detected	Autofill Detected
`Autologin Detected`	Autologin Detected	Autologin Detected
`Copy and Paste Detected`	Copy and Paste Detected	Copy and Paste Detected
`Password Manager Detected`	Password Manager Detected	Password Manager Detected
`Not Available`	Not Available	Not Available

Days since device first seen

Days Since Device First Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Default outcomes

The module is pre-configured with the following default outcomes, which can be used in evaluation and routing logic within the journey designer.

Outcome	Condition	Description
`Error`	—	[Describe.]
`High Risk`	Threat Score >= `80`	[Describe.]
`Medium Risk`	Threat Score < `80` and Threat Score >= `40`	[Describe.]
`Very Low Risk`	Identity Score >= `80` and Threat Score < `40` and Threat Score >= `0`	[Describe.]
`Low Risk`	Identity Score >= `0` and Threat Score < `40` and Threat Score >= `0`	[Describe.]
`Risk Level Not Calculated`	default, when no conditions matched	[Describe.]

Input payload

The following is a sample payload used to submit data to the Device Intelligence - Single Tenant - EU module for processing.

JSON

{
  "context": {
    "subject": {
      "uid": "variant-test-user",
      "sessions": [
        {
          "type": "deviceCheck",
          "id": "sid-6018d1ce-f5cc-489e-a901-f069d2ce19ba",
          "transaction": {
            "id": "txn-617f2bd4-f18d-43b8-af15-514bb835466f"
          },
          "user": {
            "id": "error-user"
          }
        }
      ],
      "identity": {
        "firstName": "Error",
        "lastNames": [
          "Error"
        ],
        "dateOfBirth": "1999-09-09",
        "currentAddress": {
          "premise": "999",
          "thoroughfare": "The Street",
          "locality": "Anyton",
          "postalCode": "AA9 9AA",
          "country": "US"
        },
        "phones": [
          {
            "type": "mobile",
            "number": "+44770000999"
          }
        ]
      },
      "accounts": [
        {
          "type": "Bank Account",
          "accountNumber": "11111999",
          "sortCode": "99-99-99"
        }
      ]
    }
  }
}

Field	Required	Description
`CurrentAddress`	No	[Describe.]
`CurrentAddress/lines`	No	[Describe.]
`CurrentAddress/addressString`	No	[Describe.]
`CurrentAddress/premise`	No	[Describe.]
`CurrentAddress/building`	No	[Describe.]
`CurrentAddress/subBuilding`	No	[Describe.]
`CurrentAddress/thoroughfare`	No	[Describe.]
`CurrentAddress/dependentThoroughfare`	No	[Describe.]
`CurrentAddress/locality`	No	[Describe.]
`CurrentAddress/dependentLocality`	No	[Describe.]
`CurrentAddress/doubleDependentLocality`	No	[Describe.]
`CurrentAddress/postalCode`	No	[Describe.]
`CurrentAddress/postBox`	No	[Describe.]
`CurrentAddress/country`	Yes	[Describe.]
`CurrentAddress/superAdministrativeArea`	No	[Describe.]
`CurrentAddress/administrativeArea`	No	[Describe.]
`CurrentAddress/subAdministrativeArea`	No	[Describe.]
`CurrentAddress/organization`	No	[Describe.]
`CurrentAddress/location`	No	[Describe.]
`DeviceCheck`	Yes	[Describe.]

Sample response

The following is a sample response returned by the module.

JSON

{
  "response": {
    "outcome": "Error",
    "advice": {}
  }
}

Device Intelligence - Consortium

Capabilities

The module returns the following capabilities.

Threat device score

Device-modality threat — likelihood the device itself carries risk signals associated with known fraud.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Behavioral indicators

Behavioral Indicators

Code	Label	Description
`User Behavior Recognized`	User Behavior Recognized	User Behavior Recognized
`User Behavior Partially Recognized`	User Behavior Partially Recognized	User Behavior Partially Recognized
`User Behavior Not Recognized`	User Behavior Not Recognized	User Behavior Not Recognized
`Behavior Unknown`	Behavior Unknown	Behavior Unknown
`Not Available`	Not Available	Not Available - when none of the response above is available

Users seen on device

Users Seen on Device

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Threat BOT score

Likelihood the session is driven by a bot / non-human automation (e.g. headless browser, scripted actor).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Identity device score

Device-modality match — how strongly the device fingerprint matches the genuine user’s known device(s).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Days since user first seen

Days Since User First Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

IP address indicators

IP Address Indicators

Code	Label	Description
`Anonymizer Network Detected`	Anonymizer Network Detected	Anonymizer Network Detected
`Anonymous Hosting Network`	Anonymous Hosting Network	Anonymous Hosting Network
`Public Proxy`	Public Proxy	Public Proxy
`TOR Network`	TOR Network	TOR Network
`Anonymous Network`	Anonymous Network	Anonymous Network
`Anonymous VPN`	Anonymous VPN	Anonymous VPN
`Residential Proxy`	Residential Proxy	Residential Proxy
`Not Available`	Not Available	Not Available

Days since device last seen

Days Since Device Last Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Times user seen

Times User Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Devices seen on user

Devices Seen on User

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Threat keystrokes score

Keystroke-dynamics threat — likelihood the typing behaviour is anomalous / replayed rather than a genuine user.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Bot and RAT indicators

Bot and RAT Indicators

Code	Label	Description
`Bot Not Detected`	Bot Not Detected	Bot Not Detected
`Bot Detected`	Bot Detected	Bot Detected
`Headless Browser Detected`	Headless Browser Detected	Headless Browser Detected
`Open Port Detected`	Open Port Detected	Open Port Detected
`Probably Remote Access Tool Detected`	Probably Remote Access Tool Detected	Probably Remote Access Tool Detected
`Not Available`	Not Available	When none of the response above is available

Malware indicators

Malware Indicators

Code	Label	Description
`Page Not Modified`	Page Not Modified	Page Not Modified
`Page Modified`	Page Modified	Page Modified
`Page Modified After Page Load`	Page Modified After Page Load	Page Modified After Page Load
`Malware Status Unknown`	Malware Status Unknown	Malware Status Unknown
`Not Available`	Not Available	Not Available

Identity mouse score

Mouse-behaviour match — how closely the pointer dynamics match the user’s established baseline.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Threat RAT score

Likelihood a remote-access tool is controlling the session (remote takeover / scam-in-progress).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Days since user last seen

Days Since User Last Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Internet connection type

Internet Connection Type

Code	Label	Description
`Corporate`	Corporate	Corporate
`Cellular`	Cellular	Cellular
`Cable/DSL`	Cable/DSL	Cable/DSL
`Other`	Other	Other
`Not Available`	Not Available	Not Available

Threat location score

Location-modality threat — likelihood the location signals indicate risk (e.g. impossible travel, spoofing).

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

IP address geo-Location

IP Address Geo-Location

Code	Label	Description
`IP Address Country Match`	IP Address Country Match	Codes are identical
`IP Address Country Mismatch`	IP Address Country Mismatch	Codes are not identical
`IP Address City Match`	IP Address City Match	Cities are identical
`IP Address City Mismatch`	IP Address City Mismatch	Cities are not identical
`IP Address Postcode Match`	IP Address Postcode Match	Postcodes are identical
`IP Address Postcode Mismatch`	IP Address Postcode Mismatch	Postcodes are not identical
`IP Region Match`	IP Region Match	Regions are identical
`IP Region Mismatch`	IP Region Mismatch	Regions are not identical
`IP Address Location Inconsistent`	IP Address Location Inconsistent	Distance (in meter) between the GO input address geocodes and the IP address geocode is more than the accuracy value
`IP Address Location Consistent`	IP Address Location Consistent	Distance (in meter) between the GO input address geocodes and the IP address geocode is less than the accuracy value
`Not Available`	Not Available	When none of the response is available
`No Result`	No Result	No Result

Device language

Device Language

Code	Label	Description
`en`	English	English
`pl`	Polski	Polski
`ro`	Română	Română
`es`	Español	Español
`it`	Italiano	Italiano
`tr`	Türkçe	Türkçe
`fr`	Français	Français
`de`	Deutsch	Deutsch
`pt`	Português	Português
`Other`	Other	Other
`Not Available`	Not Available	The language field is NULL or EMPTY

Location type

Location Type

Code	Label	Description
`business`	business	business
`cafe`	cafe	cafe
`cellular`	cellular	cellular
`college`	college	college
`consumer_privacy_network`	consumer_privacy_network	consumer_privacy_network
`consumer_delivery_network`	consumer_delivery_network	consumer_delivery_network
`government`	government	government
`hosting`	hosting	hosting
`library`	library	library
`military`	military	military
`residential`	residential	residential
`router`	router	router
`school`	school	school
`traveler`	traveler	traveler
`search_engine_spider`	search_engine_spider	search_engine_spider
`other`	other	In case a non-listed response value is provided by the Callsign API response (excluding NULL and EMPTY), the capability value will be set as other
`Not Available`	Not Available	In the case the response is NULL or EMPTY, the capability value will be set as Not Available

Threat score

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Identity keystrokes score

Keystroke-dynamics match — how closely the typing rhythm matches the user’s established baseline.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Device indicators

Device Indicators

Code	Label	Description
`Device Recognized For User`	Device Recognized For User	Device Recognized For User
`Device Partially Recognized For User`	Device Partially Recognized For User	Device Partially Recognized For User
`Device Not Recognised For User`	Device Not Recognised For User	Device Not Recognised For User
`New Device For User`	New Device For User	New Device For User
`Private Browsing Detected`	Private Browsing Detected	Private Browsing Detected
`Screen Lock Set`	Screen Lock Set	Screen Lock Set
`Biometric Set`	Biometric Set	Biometric Set
`Pass Code Set`	Pass Code Set	Pass Code Set
`Jailbroken Device`	Jailbroken Device	Jailbroken Device
`SIM State Ready`	SIM State Ready	SIM State Ready
`SIM State Not Ready`	SIM State Not Ready	SIM State Not Ready
`SIM State PIN Required`	SIM State PIN Required	SIM State PIN Required
`SIM State Network Locked`	SIM State Network Locked	SIM State Network Locked
`SIM State Permanently Disabled`	SIM State Permanently Disabled	SIM State Permanently Disabled
`SIM State Absent`	SIM State Absent	SIM State Absent
`SIM State Unknown`	SIM State Unknown	SIM State Unknown
`SIM State Card IO Error`	SIM State Card IO Error	SIM State Card IO Error
`Not Available`	Not Available	Not Available

Device model error

Device Model Error

Detail	Description
Type	Boolean
Default	`false`

Time based indicators

Time Based Indicators

Code	Label	Description
`Time Based Behavior Recognised`	Time Based Behavior Recognised	Time Based Behavior Recognised
`Time Based Behavior Partially Recognised`	Time Based Behavior Partially Recognised	Time Based Behavior Partially Recognised
`Time Based Behavior Not Recognised`	Time Based Behavior Not Recognised	Time Based Behavior Not Recognised
`New Profile for Time Based Behavior`	New Profile for Time Based Behavior	New Profile for Time Based Behavior
`Suspicious Time Based Behavior`	Suspicious Time Based Behavior	Suspicious Time Based Behavior
`Not Available`	Not Available	Not Available

Times device seen

Times Device Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Compromise indicators

Compromise Indicators

Code	Label	Description
`No Replay Detected`	No Replay Detected	No Replay Detected
`Replay Detected`	Replay Detected	Replay Detected
`Keystrokes Replay Detected`	Keystrokes Replay Detected	Keystrokes Replay Detected
`Mouse Replay Detected`	Mouse Replay Detected	Mouse Replay Detected
`Debugger Connected`	Debugger Connected	Debugger Connected
`Device Unsecured`	Device Unsecured	Device Unsecured
`No Screen Lock`	No Screen Lock	No Screen Lock
`Data Integrity Check Failed`	Data Integrity Check Failed	Data Integrity Check Failed
`Device Hooked`	Device Hooked	Device Hooked
`Emulator Detected`	Emulator Detected	Emulator Detected
`Resources Modified`	Resources Modified	Resources Modified
`Swizzled`	Swizzled	Swizzled
`Tampering Detected`	Tampering Detected	Tampering Detected
`Collection Time Not Confirmed`	Collection Time Not Confirmed	Collection Time Not Confirmed
`Not Available`	Not Available	Not Available When none of the response above is available

Threat mouse score

Mouse-behaviour threat — likelihood the pointer dynamics are anomalous / automated.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Location indicators

Location Indicators

Code	Label	Description
`Location Recognized`	Location Recognized	Location Recognized
`Location Partially Recognized`	Location Partially Recognized	Location Partially Recognized
`Location Not Recognised`	Location Not Recognised	Location Not Recognised
`Suspicious Location Movement`	Suspicious Location Movement	Suspicious Location Movement
`Suspicious Location Source Mismatch`	Suspicious Location Source Mismatch	Suspicious Location Source Mismatch
`New Profile for Location`	New Profile for Location	New Profile for Location
`Not Available`	Not Available	Not Available - When none of the response above is available

Device OS

Code	Label	Description
`iOS`	iOS	iOS
`Android`	Android	Android
`Windows`	Windows	Windows
`macOS`	macOS	macOS
`Linux`	Linux	Linux
`Other`	Other	For other response & other non-NULL / non-Empty
`Not Available`	Not Available	Not Available if the mapped field value is NULL or EMPTY

Identity score

Ensembled (aggregate) identity score — overall likelihood the user is who they claim to be, across all identity modalities. Second-stage gate for Very Low / Low Risk.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Time zone offset

Time Zone Offset

Detail	Description
Type	Integer
Range	-720–720
Default	`0`

Identity location score

Location match — how consistent the location is with the user’s known mobility / location history.

Detail	Description
Type	Integer
Range	-999–100
Default	`0`

Time zone region

Time Zone Region

Code	Label	Description
`Africa`	Africa	Africa
`America`	America	America
`Antarctica`	Antarctica	Antarctica
`Arctic`	Arctic	Arctic
`Asia`	Asia	Asia
`Atlantic`	Atlantic	Atlantic
`Australia`	Australia	Australia
`Europe`	Europe	Europe
`Indian`	Indian	Indian
`Pacific`	Pacific	Pacific
`Other`	Other	Other
`Not Available`	Not Available	The language field is NULL or EMPTY

Device type

Device Type

Code	Label	Description
`WEB`	WEB	WEB
`ANDROID`	ANDROID	ANDROID
`IOS`	IOS	IOS
`Not Available`	Not Available	Not Available

Device category

Device Category

Code	Label	Description
`desktop`	desktop	desktop
`tablet`	tablet	tablet
`smartphone`	smartphone	smartphone
`feature phone`	feature phone	feature phone
`Smart TV`	Smart TV	Smart TV
`robot`	robot	robot
`other non-mobile`	other non-mobile	other non-mobile
`other mobile`	other mobile	other mobile
`Other`	Other	When other non-NULL / non-Empty responses
`Not Available`	Not Available	If the mapped field value is NULL or EMPTY

Device language country

Device Language Country

Code	Label	Description
`GB`	United Kingdom	United Kingdom
`US`	United States	United States
`PL`	Poland	Poland
`AU`	Australia	Australia
`IN`	India	India
`IE`	Ireland	Ireland
`RO`	Romania	Romania
`CA`	Canada	Canada
`ZA`	South Africa	South Africa
`ES`	Spain	Spain
`Other`	Other	Other
`Not Available`	Not Available	If the language field is NULL or EMPTY

Threat indicators

Threat Indicators

Code	Label	Description
`Threat Not Detected`	Threat Not Detected	Threat Not Detected
`Threat Detected`	Threat Detected	Threat Detected
`Strong Biometric Risk Detected`	Strong Biometric Risk Detected	Strong Biometric Risk Detected
`Biometric Risk Detected`	Biometric Risk Detected	Biometric Risk Detected
`Device Risk Detected`	Device Risk Detected	Device Risk Detected
`Location Risk Detected`	Location Risk Detected	Location Risk Detected
`Not Available`	Not Available	Not Available

Keystrokes and mouse behavior

Keystrokes and Mouse Behavior

Code	Label	Description
`Keystrokes Recognized`	Keystrokes Recognized	Keystrokes Recognized
`Keystrokes Partially Recognized`	Keystrokes Partially Recognized	Keystrokes Partially Recognized
`Keystrokes Not Recognized`	Keystrokes Not Recognized	Keystrokes Not Recognized
`New Profile for Keystrokes`	New Profile for Keystrokes	New Profile for Keystrokes
`Mouse Behavior Recognized`	Mouse Behavior Recognized	Mouse Behavior Recognized
`Mouse Behavior Partially Recognised`	Mouse Behavior Partially Recognised	Mouse Behavior Partially Recognised
`Mouse Behavior Not Recognized`	Mouse Behavior Not Recognized	Mouse Behavior Not Recognized
`New Profile for Mouse Behavior`	New Profile for Mouse Behavior	New Profile for Mouse Behavior
`Autofill Detected`	Autofill Detected	Autofill Detected
`Autologin Detected`	Autologin Detected	Autologin Detected
`Copy and Paste Detected`	Copy and Paste Detected	Copy and Paste Detected
`Password Manager Detected`	Password Manager Detected	Password Manager Detected
`Not Available`	Not Available	Not Available

Days since device first seen

Days Since Device First Seen

Detail	Description
Type	Integer
Range	-999–2147483647
Default	`0`

Default outcomes

The module is pre-configured with the following default outcomes, which can be used in evaluation and routing logic within the journey designer.

Outcome	Condition	Description
`Error`	—	[Describe.]
`High Risk`	Threat Score >= `80`	[Describe.]
`Medium Risk`	Threat Score < `80` and Threat Score >= `40`	[Describe.]
`Very Low Risk`	Identity Score >= `80` and Threat Score < `40` and Threat Score >= `0`	[Describe.]
`Low Risk`	Identity Score >= `0` and Threat Score < `40` and Threat Score >= `0`	[Describe.]
`Risk Level Not Calculated`	default, when no conditions matched	[Describe.]

Input payload

The following is a sample payload used to submit data to the Device Intelligence - Consortium module for processing.

JSON

{
  "context": {
    "subject": {
      "uid": "variant-test-user",
      "sessions": [
        {
          "type": "deviceCheck",
          "id": "sid-6018d1ce-f5cc-489e-a901-f069d2ce19ba",
          "transaction": {
            "id": "txn-617f2bd4-f18d-43b8-af15-514bb835466f"
          },
          "user": {
            "id": "error-user"
          }
        }
      ],
      "identity": {
        "firstName": "Error",
        "lastNames": [
          "Error"
        ],
        "dateOfBirth": "1999-09-09",
        "currentAddress": {
          "premise": "999",
          "thoroughfare": "The Street",
          "locality": "Anyton",
          "postalCode": "AA9 9AA",
          "country": "US"
        },
        "phones": [
          {
            "type": "mobile",
            "number": "+44770000999"
          }
        ]
      },
      "accounts": [
        {
          "type": "Bank Account",
          "accountNumber": "11111999",
          "sortCode": "99-99-99"
        }
      ]
    }
  }
}

Field	Required	Description
`CurrentAddress`	No	[Describe.]
`CurrentAddress/lines`	No	[Describe.]
`CurrentAddress/addressString`	No	[Describe.]
`CurrentAddress/premise`	No	[Describe.]
`CurrentAddress/building`	No	[Describe.]
`CurrentAddress/subBuilding`	No	[Describe.]
`CurrentAddress/thoroughfare`	No	[Describe.]
`CurrentAddress/dependentThoroughfare`	No	[Describe.]
`CurrentAddress/locality`	No	[Describe.]
`CurrentAddress/dependentLocality`	No	[Describe.]
`CurrentAddress/doubleDependentLocality`	No	[Describe.]
`CurrentAddress/postalCode`	No	[Describe.]
`CurrentAddress/postBox`	No	[Describe.]
`CurrentAddress/country`	Yes	[Describe.]
`CurrentAddress/superAdministrativeArea`	No	[Describe.]
`CurrentAddress/administrativeArea`	No	[Describe.]
`CurrentAddress/subAdministrativeArea`	No	[Describe.]
`CurrentAddress/organization`	No	[Describe.]
`CurrentAddress/location`	No	[Describe.]
`DeviceCheck`	Yes	[Describe.]

Sample response

The following is a sample response returned by the module.

JSON

{
  "response": {
    "outcome": "Error",
    "advice": {}
  }
}

​Capabilities

​Threat device score

​Behavioral indicators

​Users seen on device

​Threat BOT score

​Identity device score

​Days since user first seen

​IP address indicators

​Days since device last seen

​Times user seen

​Devices seen on user

​Threat keystrokes score

​Bot and RAT indicators

​Malware indicators

​Identity mouse score

​Threat RAT score

​Days since user last seen

​Internet connection type

​Threat location score

​IP address geo-Location

​Device language

​Location type

​Threat score

​Identity keystrokes score

​Device indicators

​Device model error

​Time based indicators

​Times device seen

​Compromise indicators

​Threat mouse score

​Location indicators

​Device OS

​Identity score

​Time zone offset

​Identity location score

​Time zone region

​Device type

​Device category

​Device language country

​Threat indicators

​Keystrokes and mouse behavior

​Days since device first seen

​Default outcomes

​Input payload

​Sample response

​Capabilities

​Threat device score

​Behavioral indicators

​Users seen on device

​Threat BOT score

​Identity device score

​Days since user first seen

​IP address indicators

​Days since device last seen

​Times user seen

​Devices seen on user

​Threat keystrokes score

​Bot and RAT indicators

​Malware indicators

​Identity mouse score

​Threat RAT score

​Days since user last seen

​Internet connection type

​Threat location score

​IP address geo-Location

​Device language

​Location type

​Threat score

​Identity keystrokes score

​Device indicators

​Device model error

​Time based indicators

​Times device seen

​Compromise indicators

​Threat mouse score

​Location indicators

​Device OS

​Identity score

​Time zone offset

​Identity location score

Capabilities

Threat device score

Behavioral indicators

Users seen on device

Threat BOT score

Identity device score

Days since user first seen

IP address indicators

Days since device last seen

Times user seen

Devices seen on user

Threat keystrokes score

Bot and RAT indicators

Malware indicators

Identity mouse score

Threat RAT score

Days since user last seen

Internet connection type

Threat location score

IP address geo-Location

Device language

Location type

Threat score

Identity keystrokes score

Device indicators

Device model error

Time based indicators

Times device seen

Compromise indicators

Threat mouse score

Location indicators

Device OS

Identity score

Time zone offset

Identity location score

Time zone region

Device type

Device category

Device language country

Threat indicators

Keystrokes and mouse behavior

Days since device first seen

Default outcomes

Input payload

Sample response

Capabilities

Threat device score

Behavioral indicators

Users seen on device

Threat BOT score

Identity device score

Days since user first seen

IP address indicators

Days since device last seen

Times user seen

Devices seen on user

Threat keystrokes score

Bot and RAT indicators

Malware indicators

Identity mouse score

Threat RAT score

Days since user last seen

Internet connection type

Threat location score

IP address geo-Location

Device language

Location type

Threat score

Identity keystrokes score

Device indicators

Device model error

Time based indicators

Times device seen

Compromise indicators

Threat mouse score

Location indicators

Device OS

Identity score

Time zone offset

Identity location score