These examples show how a coherent board combines headline metrics, trends, ranked entities and investigation links. They use the ecommerce demonstration configuration; adapt the step names, identity fields and signal definitions to your integration.
Account takeover and credential stuffing
Start with login-event and distinct-account counts. Add event volume by outcome and channel, then add two distinct-count tables: accounts per device and devices per account. Compare matched authentication signals over time, and inspect the highest-count rows in Investigations.
For accounts per device, use the configuration in the Top X article. Before acting on a high count, check for missing grouping values, shared devices and legitimate repeated use. Confirm the actual decision and login outcome on contributing events.
Registration abuse
Filter the relevant cards to step_name = 'signup_submit'. Use Aggregate Stats for signup events, recorded rejects and distinct devices. Add signup decisions over time, signal activity and ranked devices/IPs.
Counting distinct identifier values per device answers “how many signup events?” Counting distinct account tokens answers “how many accounts?” Choose deliberately. Investigate the events before describing multiple registrations as abuse.
Birthday offers and checkout
Combine checkout counts with the actual business condition that identifies the promotion. Count distinct accounts per device for qualifying checkouts and compare the decisions over time. Keep anonymous and authenticated checkout populations explicit.
A product or promotion attribute is integration-specific. A generic checkout filter alone does not isolate birthday-offer activity. Include the qualifying condition in both the numerator and denominator of any rate you report.
Gift-card testing
Filter balance-check and gift-card-checkout activity separately. Compare balance-check volume per IP and device, matched testing signals and recorded decisions. A sharp rise in checks without a comparable rise in purchases is an investigation lead.
Check whether an IP represents a shared network before treating its count as a single actor. A framework-detection field and a known-bot classification are different measures and can yield different totals.
Promotion-code activity
Use distinct accounts per device and per IP to identify concentration, then inspect the submitted promotion events. Compare event activity with recorded outcomes and relevant signals.
No rejects does not necessarily mean no suspicious activity. The step may be monitoring traffic without enforcing a decision. Confirm the deployed decision strategy before interpreting its outcomes.
Bots and automation
Start with Bot Type volume over time, then group matching events by step and recorded outcome. Add proxy/VPN trends and exit-network context. This answers both “where is automation active?” and “what decisions were recorded for it?”
Signal health
Use Signal Trigger Rate to inspect trigger counts, rates and previous-period values. Add custom columns for reject share and distinct accounts when useful. Compare a signal change with deployment timing, traffic composition and profiling coverage before deciding it reflects a detection regression.
Use the two-variable reject-share example in the Signal Trigger Rate article. Validate it against an investigation of the same journey, step, signal and period.
Coverage and gaps
Create a board that separates collection-only, monitor-only and decision-enforcing steps. Count events missing the required profiling or identity fields. Break those counts down by step and channel so the owner can identify where the integration needs attention.
A zero count for an SDK-dependent signal may reflect a missing prerequisite rather than a clean population. Compare the signal with the associated SDK, profiling and attribute coverage.
Validate each new metric
- Write the question in one sentence, including its unit: events, accounts, devices, signals or currency.
- Record the node, date range and timezone.
- Specify the event filter, grouping attributes, calculation and result limit.
- Inspect a sample of contributing events.
- Check missing values and duplicated identities.
- Put the definition in the card description so the next reader can reproduce it.
The example boards illustrate possible analyses. They do not prescribe a risk policy or confirm fraud in the demonstration traffic.