> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Investigate the Data

#### Deep-dive into specific traffic in the Dashboard

The Investigation page is made up of two correlating tabs; **Analyzer** and **Forensics**. The **Analyzer** tab presents detailed search results and insights into traffic sources. The **Forensics** tab presents the Activity Timeline, a raw data table relevant to the search parameters.

The Investigation toggle allows you to navigate between the the **Analyzer** and **Forensics** tabs.

![](/_fern-img/8aa020dbbf86bb75bec1f46baa6e43b695a1928d0952a699400ec4a7deca9dbd.webp)

## Incident Types

| Type ID | Name                    | Description                                                                          |
| ------- | ----------------------- | ------------------------------------------------------------------------------------ |
| 12      | UI Anomaly              | User interface interaction is typical of non-human users                             |
| 13      | Denied Service          | One or more of the client's properties was denied                                    |
| 14      | Custom Denylist         | The request was denied because of a customer defined rule                            |
| 15      | Cloud Service           | The request was detected as a cloud service                                          |
| 16      | Anonymizing Service     | Request originates from a Cloud Provider, VPN, Anonymizing Proxy or spoofed IP       |
| 17      | Bot Behavior            | Behavioral patterns deviate from typical human activity                              |
| 18      | Spoof                   | The detected browser does not match the declared browser                             |
| 19      | Predictive Analytics    | Anomalies in behavioral data relevant for the request                                |
| 20      | Automation Tool         | Request properties indicate the use of an automation tool                            |
| 21      | Bad Reputation          | In the past, users with the same properties performed malicious activities           |
| 22      | Volumetric Rule         | Activity exceeded volumetric policy definition                                       |
| 23      | Missing Sensor Data     | JS Sensor information was not sent                                                   |
| 24      | Allowed Volume Exceeded | Request volume anomaly detected                                                      |
| 25      | Captcha Solving Attack  | Indications of a CAPTCHA solving attack such as solving farms and solving automation |

## Investigation Time Range

When the Investigation page is opened independent of a **Search**, all of the account data is presented for the Time Range selected.

If the Time Range applied to the search is more than 14 days, the last 14 days of data is presented.

## Filters

The filters in the Investigation page allow users to fine-tune the data presented. The filters in the Investigation page are the same filters as in the `Dashboard`\_, but apart from the Time Range and the Applications selected do not carry over from the Dashboard during a search. The filters affect all data in the Investigation page.

## Investigation Analyzer

![](/_fern-img/8786e31ec78bc096a0b7f07a5caf9434e8dacb95d19d4c2e678533fe6673be6c.webp)

The data generated by the search is presented in the Analyzer tab. A breakdown of all traffic sources contributing to the total percentage are listed.

Included in the Analyzer tab are the following components:

* Traffic Over Time
* Incident Types
* Top Countries
* Cloud Vendors
* Services IP Classification
* Top Paths
* Top 10 IPs
* Top User Agents
* Header Referrers
* To 10 ASN Organizations

Also included in the Investigation tab is the Activity Timeline. This table presents the raw data used to create the components in the tab.

## Investigation Forensics (Activity Timeline)

![](/_fern-img/a6f762077400253fb2c81f8c0047a670ffb4244fe64349886f2cc398533057ce.webp)

The raw data table is displayed in the Forensics tab. It allows users to investigate raw data relevant to the information presented in the Analyzer components. The data is subject to the applied filters and provides up to the most 60,000 recent requests.

Users can choose which data is presented in the table by adding or removing various columns. The table's configuration is saved per user.

### Search

The data in the Forensics table can be filtered per column(s) of interest.

![](/_fern-img/7da34be79c0570786661a0ba4a129120bf715df0a214f74fa9c7bbda95de9eb3.webp)

Some tips for searching the Forensics table:

* Enter the column name followed by `:` eg. Traffic Types:
* There must be a space between the `:` and the value
* Column names are not case sensitive
* All operators can be used

**Search example**: Traffic type: Legitimate Requests AND (ip: 27.62.247.167 OR IP: 1.64.71.81)

Table data can be exported to a CSV file with a maximum of 60K rows.