Operations
Signals & analyst evidence
Understand browser, behavioral, network, velocity, and identity evidence used in scoring and case investigation.
On this page
Evidence families
| Family | Evidence |
|---|---|
| Browser & automation | Headless/framework indicators, capability inconsistencies, fingerprint spoofing, and evasion. |
| Behavior | Interaction absence, implausible timing/motion, replay patterns, and sample consistency. |
| Freshness | Timestamp, nonce, and request consistency evidence carried by complete telemetry. |
| Network | Observed IP, proxy/datacenter patterns, and available transport/browser consistency. |
| Velocity & credentials | Signup/checkout bursts, account reuse, and server-validated login outcomes. |
| Identity & payment | Shared device/IP/payment identifiers, account links, promo reuse, and fraud rings. |
| ML signals | Enterprise model signals where the deployed model has evidence available. |
Detection depends on available evidence, enabled rules, and plan access. A signal name is not a guarantee that every transport measurement exists behind every proxy. Preserve signal.description to inspect the actual observation rather than inferring a transport capability from the name alone.
Supply real login outcomes
const request = await bastion.buildRequest({
event_type: 'login',
account_id: 'customer_123',
});
// Send to your own login handler. That handler validates credentials.
// On the server, after your authentication provider completes:
const decision = await serverBastion.verify({
...request,
context: {
event_type: 'login',
account_id: authenticatedOrAttemptedAccountId,
login_succeeded: credentialsWereValid,
},
});The final two values above are outputs of your server-side authentication logic. A client-provided login_succeeded value is not trusted. Keeping the result absent when it is unknown is preferable to inventing an outcome. Credential-stuffing evidence uses verified server outcomes where available.
Investigate with the fraud analyst
The dashboard analyst uses account events, rule evidence, identity links, and the newer anti-bot signals to answer distinct questions about the case. Graph access and ring evidence are plan-gated. Use it to understand observations and next steps, then record your actual review outcome.