Account-security widgets identify patterns worth reviewing, such as failed logins or an account identifier appearing across multiple devices. They provide investigation leads; their names do not establish that an attack succeeded.
Suspicious Devices
The Suspicious Devices menu entry appears in examples as Suspect Devices. It lists device signatures with failed login activity, along with first-seen information and successful and failed login counts.
- Open the card and set the relevant period.
- Expand it to read the columns.
- Sort by failed logins or another supported header.
- Open the event-search action for a device signature.
- Inspect the login events, account identifiers, network context and decisions.
This predefined widget recognises the event types account_login_failed and account_login_success. In the examined implementation, a device qualifies when its failed-login count is greater than zero. If your journey uses different event types, build an equivalent Top X view using the fields your integration actually records.
Potential Victims
Potential Victims lists account-identifier values observed across more than two distinct device signatures during the selected period's login events. It shows last interaction, identifier attribute, value, programmatic name and device count.
Inspect the attribute type before interpreting the row. Email, username, login and customer-token values can describe the same person in different ways. The same person can therefore appear in more than one row. Shared accounts, changed devices and legitimate travel can also produce multiple signatures.
Use the row's event-search action to inspect its activity. Check the events and the account's expected behaviour before raising or resolving an incident.
Attack Velocity
Attack Velocity compares a predefined multi-device account indicator with login volume over time.
The examined calculation counts qualifying account-identifier entries associated with more than two device signatures within a time bucket. It compares those entries with the number of successful/failed login events. A person represented by several identifier types can contribute more than once, and the two series do not have the same unit.
Use this chart to locate a period for investigation. For a specifically defined metric such as “login events from devices associated with more than five accounts,” create a suitable configurable analysis and state that definition in the card description.
Build a tailored account-security board
Combine:
- Aggregate Stats for login events, distinct accounts and recorded rejects.
- Distinct accounts per device and distinct devices per account.
- Velocity of Value for login activity by channel or outcome.
- Signal counts and signal-trigger rates for the relevant authentication signals.
- A supporting investigation query with account, device and network columns.
Use your organisation's actual step names, identity fields and model semantics. Example thresholds in a demonstration board are starting points for analysis, not default Darwinium blocking rules.