1. Go to Attack management.
  2. Click on a client row in the Anomalous client list table, to navigate to the Indicators of Attack and Anomalies dashboard, that lists detected IoAs and anomalies for the client.
  3. To view the list of transactions that generated the IoA or anomaly on a row in the Anomalous client list table, click the three-dot drop down on the right, and then click View transactions.
    Note: The list of transactions appears with one of the headings:
    • Transactions: The list displays all the transactions involved in the IOA detection.
    • Sample Transactions: When the number of transactions is large, the list displays a sampling of the transactions involved in the IOA detection.
    Intelligence IoA API transactions
  4. Click the down arrow on the right of a transaction to view parameter values in the tabs:
    • Details tab: View parameter values of the transaction's host name, username, token, IP address, response content type and response payload size.
      Intelligence IoA transaction details
    • Request headers tab: View the transaction's request header parameter values. Examples include authorization type, accept-encoding, host name, and accept response's content type.
      Intelligence IoA transaction request header
    • Response headers tab: View the transaction's response header parameter values. Example include content type and content length.
      Intelligence IoA transaction response header
  5. Click X at the top right, to return to the previous dashboard.