1.5.22 - September 12, 2025
Copilot (beta)
Darwinium Copilot serves as an intelligent assistant for fraud investigations and platform interaction. Its core mission is to streamline user queries around complex fraud detection points of interest.
Copilot is built into the Darwinium portal as an omnipresent chat window, and can execute deep interrogation and inspection. It is equipped with awareness around event attributes that your organization have populated, signals generated, and features implemented. It is also contextually aware of content the user is viewing on the page.
Examples of such chat interactions are:
“provide a query that helps find events where there was no profiling present or where there was session replay”
“provide a query that helps find login events where there was potential credential stuffing”
“interpret the graphs that are visible on my page”
“interpret the identity graph on my page and provide insights into the linked entities. Tell me whether this is unusual”
“look at the event that i currently have open on my page. Tell me any interesting anomalies that i should be concerned about. Select any other events on the table i have open on my page that exhibit similar characteristics”
“select columns on the table on my page that would be best suited for investigating bot-like users”
“inspect the features file i have open. Edit to provide additional features that would assist in detecting credential stuffing. Explain your reasoning”
Copilot is currently in beta for select customers through the chat button on the top navigation or by hitting ctrl/cmd+. If you wish to obtain early access, please contact us to enable it.
Journey Transition probability
Journey transition probability aims to leverage multi-step interactions to answer the question “should this user be on this step?”, considering both the ordering of transitions and the timing information.
The Journey transition probability is a calculation of probabilities of different user journeys as compared with the broader population and the user’s own history. Anomalous behaviour and risk is quantified using the observed behaviorism distributions. For both the global and particular user context the calculated probabilities include:
Probability of the last transition between observed journey steps
Probability of the sequence of steps of the journey
Probability of a journey hitting a particular step within the number of transitions or within the elapsed time, from the observed starting point
Probability of being at a particular step after the number of transitions or elapsed time on a journey
Learn more about journey model features
Visual Search
When performing investigations, users now have the option to use Darwinium's Visual Query Editor, which provides a streamlined user experience for filtering data without requiring knowledge of Darwinium's SQL-like query language.
This intuitive interface creates an easy entry point for data exploration while offering natural up skilling opportunities for users who want to transition to more advanced query capabilities.
Key Features:
Visual Query Construction: Build complex queries through a guided, step-by-step visual interface without writing any code
Searchable Attribute Dropdown: Easily discover and select from all available query attributes with intelligent search functionality
Smart Value Selection: For attributes with predefined values (like signals and enums), get a searchable list of all possible options for effortless selection
Seamless DSL Integration: Visual queries automatically generate equivalent query language syntax, providing learning opportunities for users ready to explore Darwinium's full SQL-like query language
Simplified Search reduces the learning curve and makes Darwinium's powerful query capabilities more discoverable, enabling fraud analysts to focus on insights rather than syntax while creating a natural pathway to advanced querying skills.
Identifier graph improvements
The identifier graph has received a significant amount of engineering love for our 1.5.22 release, and includes the following enhancements:
lassoo select - Filter the timeline or selected events to selected identifiers by simply holding
shiftand drawing around the nodes with your cursor. Selection can also be updated by holdingIdentifier display enhancments - Show Operating System on Devices, location of IP addresses, and domain for email addresses (where PII is hidden). The tooltip also shows additional high-level context around the identifier
Non-local identifiers are marked with a with a badge to denote that they exist outside of your organization
Dashboards
Signal Velocity Dashboard
The signals velocity dashboard enables you to view the velocity of signals (such as profiling.device.signals over a given time range with the ability to optionally segment by a particular attribute (such as browser, operating system, country). This enables you easily to see common patterns in various cohorts of your implementation
Investigations enhancements
Several “quality of life” improvements have been made to Darwinium’s Investigations view that streamline reviews and reduce the number of clicks needed to achieve common actions
Ability to add data points from sidebar as columns
When an attribute of interest is found in the sidebar, simply hover over the value and select “add as column” to have this appended to the events grid:
Right-click column in query view to add visualization
Select a column header to automatically create a graph on the columns contents:
Built-in signals: improved descriptions
We now provide detailed descriptions on signals shown in the sidebar. These can be viewed by hovering the “i” icon next to a signal name
Data Export - DataBricks
There is high value placed in the Darwinium data, and we heard the desire for that data to be ported directly into centralised data lakes and data warehouses for direct analysis. DataBricks the first end to end supported lakehouse integration using AWS S3 as a staging bucket. Data Exporter to Databricks Lakehouses is now generally available with more lakehouses and staging locations planned for subsequent releases.
Darwinium to Databricks export
Darwinium exports events at regular intervals as parquet format to an AWS S3 staging bucket in your environment which is then consumed into the Databricks streaming tables.
Darwinium provided DataBricks instructions
Darwinium has created the guidance and schemas to use for pulling the Darwinium event data from this staging bucket into your DataBricks instance as a streaming table.
Note: due to Darwinium’s strong posture of not processing any Personally Identifiable Information (PII), PII attribute values are necessarily exported in hashed form. It is recommended to have a non PII identifier for joining and merging purposes in your Darwinium integration (example:
identity[‘ACCOUNT’].customer_token_customer_token)Please refer to the documentation pages for more details regarding configuration, scheduling, permission model and schemas.
Rule Editor v2 – UI Overhaul
Darwinium Rule Editor v2 is an overhaul on the rule editing experience. We wanted to enable faster rule creation, easier maintenance and greater confidence that new rules were created as intended.
Improved Usability:
Drag and drop for rule insertion and reordering
Multi-selection of rules allows batched rule operations to iterate faster
Right click for rule: Insert, Cut, Copy, Paste, Duplicate. both within and across different rules files allows more flexible editing.
Rule parameter column grid, with resizing and sorting allows always seeing the relevant rule setup information clearly.
ability to reference other rules in a rule file by signal name
Consolidated Rule Editing Screen: Consolidated single rule editing modal for setting conditions, attributes and adding or deleting labels
Inline Analytics: Instantly view rule trigger volumes over the past month, including historical accept/reject outcomes—simulate impact before going live.
Rule Groups: Organize and manage logic with collapsible rule groupings.
Export to CSV: Export rules directly for easier sharing and offline analysis.
Self-configured SSO
Previously the provisionment of Single Sign-On (SSO) involved interaction between customers and Darwinium’s professional services team to onboard.
New functionality accessible to administrators has been added to our portal to streamline this setup for customers using Okta, Microsoft Azure AD and Google identity
Search Syntax Enhancements
Darwinium continues to add functionality and convenience to its global query language for search and rules. New functions added in the 1.5.22 release:
Time range convenience functions (eg. hours, days years)
Time ranges can be used in conjunction with functions such as now() to set ranges on dates. For example if the user wishes to find all events where the iOS boot time was less than 6 months ago, they could use the following:
profiling.ios.boot_time > (now() - 6 month)
..or a query for iOS boot times that were less than 5 minutes from the event timestamp:
profiling.ios.boot_time > (timestamp - 5 minute)...or a query to show all events in July:
month(timestamp) = 7
dayOfWeek
For example, to get all events that happened on a monday, you can use:
dayOfWeek(timestamp) = 1
modelScore
The modelScore function provides great shorthand to model scores across steps. The editor also provides auto-complete functionality for models using ctrl-space
for example - to find all events where a model called ‘ATO rules’ has a score of less than 300, the following would be used:
modelScore("ATO rules") < 300Bug fixes and Miscellaneous improvements
Journey build speed improvements
Added quantile graphs for biometric stats
Features now explicitly set with_scope upon creation in editor
Fixed Secure ID nonce generation - previously this was sporadically missing