Risky IP

The Risky IP chart lists the high-risk IPs that have been encountered most frequently during risk evaluations. For each such IP, it shows the total number of events and information such as last location and internet service provider (ISP).

The chart also allows you to view detailed information for each of the risk evaluation events for the high-risk IPs.

To display only a subset of the IPs or of the individual events, use the time period selector and the search bar.

To get a more exact date range, use the filter in the sidebar.

To see why an IP was categorized as high-risk, click View Details.

When you review the listed IPs, you might see that some IPs are categorized as high-risk, but they’re IPs that you know are used by legitimate users. You can then add these IPs to the allow list in the relevant risk predictor, such as anonymous IP risk predictor, or define a composite predictor where you map the relevant ISP or IP range to low-risk level.

After you have added any IPs in the chart to the allow list, you can identify the high-risk IPs and deal with them in the framework of a risk policy or handle them with other tools that your organization uses.