You can use the Risk Heat Map to determine where high-risk transactions have originated. The circles vary in size according to the number of high-risk transactions in that area.

To access the Risk Heat Map, go to Monitoring > Threat Protection.

Click the map to view drill-down information.

A screen capture showing the Risk heat map. High-risk transactions are grouped together and shown on a world map. Below the risk heat map is the drill-down table.

Click on a circle or use the scroll function to zoom in on a location.

The drill-down table shows more detailed information about each high-risk event, including:

  • IP address
  • Target application
  • IP reputation

Only events that have triggered a specific risk model, such as geovelocity anomaly, or have an aggregated risk score of high are shown. The aggregated risk score is determined by the selected risk policies in the Policy Name list.

Scroll to the right to see additional columns. For use of the filtered search bar, see Filtered searching.

For a description of the table columns, see Monitored risk data.

Zooming in on a location filters the results on the drill-down table. You can click a column header to sort the results by that value. Results are sorted by the Time column by default, with the most recent entries listed first.