The first step in detecting suspicious activity is understanding what’s already happening in your environment.

Send your existing usage logs to Verosint, either using the API or CLI. Verosint automatically analyzes user behavior, highlights anomalies, and surfaces risky patterns.

The richer the event data, the more precise our threat detection. Results are visualized in the Threats inbox, Account Intelligence, the Event Explorer and SignalPrint, where you can easily see detected threats, investigate accounts, and analyze user activity.

📘

Processing Identifiers

• Only valid identifiers on an event are processed and enriched with Verosint signals.
• If at least one identifier is valid, the event is saved and signals are processed for valid data only.
• If no identifiers are valid, the event is discarded and no signals are processed.

Supported Identifier Fields

The following table lists the fields that you can submit to Verosint:

📘

Specifying Identifiers

• Event type, IP address, and user agent are required.
• If you add events without an account ID or an email address, they will not display in SignalPrint.
• If there is an email address but no account ID, it will display in SignalPrint if the email has history against other events with more data.

Each event may have at most one identifier for each type. For example, each event can only have a single IP address.

Event Types

The following table lists event types that you can submit to Verosint: