Analyst Introduction

Prerequisites#

Ask an administrator for an active account with events:view, reviews:view, reviews:manage, and graph:view. Modules also depend on the workspace plan.

Investigation workflow#

1. Start in Event Explorer and filter by action, score, date, or identifier.
2. Open an evaluation and review its action, reason codes, signal contributions, and decision path.
3. Open Graph Explorer when shared devices, identities, IPs, or payment instruments require investigation.
4. Create or open a review, record a concise evidence-based note, and move it through the review lifecycle.
5. Resolve the case and submit confirmed_fraud or false_positive feedback when the business outcome is known.

Interpretation guardrails#

• A high score is a prioritization signal, not proof of fraud.
• Reason codes explain contributing signals; investigate the underlying customer context.
• The historical graph reflects the assessment-time neighborhood and may differ from current state.
• Do not copy customer PII into review notes unless your company policy permits it.

Expected outcome#

A completed investigation has a clear case status, a short decision rationale, and feedback tied to the original assessmentId.

Continue with Event Explorer, Reviews, and Risk Scores.