S3 export | cside docs

The Device Intelligence S3 export writes every completed evaluation to an S3 bucket you own, so you can load fingerprint and risk data into your own warehouse, fraud tooling, or analytics pipeline. Each record contains the full device fingerprint plus the network, IP, geo, VPN, bot, and behavioral signals cside computed for that visit.

Paid Device Intelligence feature

The S3 export is available on paid Device Intelligence plans and for the duration of an active Device Intelligence trial. Enable and configure it under Settings > Device Intelligence in the dashboard. If your plan lapses, cside keeps your export configurations and pauses delivery, and the tab is replaced by an upgrade prompt, so exports cannot be edited or deleted until you upgrade. Delivery resumes on its own after you upgrade, with no reconfiguration.

How delivery works

Format: JSONL (JSON Lines, application/x-ndjson) or Apache Parquet. You pick the format per export in the dashboard. In JSONL, each line is one complete evaluation record. Parquet packs the same records into a columnar file you can load straight into a warehouse or query engine.
Cadence: cside uploads once per day. Each run covers the previous full UTC day. A day with no completed evaluations produces no objects.
Object layout: objects land under a self-describing, partitioned path (see below).
Deduplicated: each evaluation appears once, as its latest computed version. Re-running a day overwrites the same objects in place, so there are no duplicate rows to reconcile.
Destination: your bucket. cside writes objects but never reads or lists them.

Objects are named:

<path prefix>/cside-fingerprints/team=<team_id>/dt=<YYYY-MM-DD>/fingerprints-<HH>.<ext>

dt=<YYYY-MM-DD> is the UTC day the records belong to, and <HH> is the two-digit UTC hour, so a day’s export is split into one object per hour that had evaluations. <ext> is jsonl or parquet. The team= and dt= segments are Hive-style partitions, so query engines such as Athena, Glue, and Spark prune on them automatically.

Set up the export

Choose a bucket and a path prefix

Create or pick an S3 bucket, and decide on a path prefix for the export, such as fingerprints/. cside writes only under that prefix, which keeps the export separate from anything else in the bucket. The prefix is optional. Without one, cside writes to the root of the bucket.

Grant cside write access

Add this statement to your bucket policy, under Permissions in the S3 console:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCsideNotificationExport",
      "Effect": "Allow",
      "Action": ["s3:PutObject"],
      "Resource": "arn:aws:s3:::<your-bucket>/*",
      "Principal": {
        "AWS": ["arn:aws:iam::590183952644:role/prod-cside-notifications-engine-sa-role"]
      }
    }
  ]
}

Replace <your-bucket> with your bucket name. The grant is write-only: s3:PutObject lets cside add objects and nothing else, so cside cannot list, read, or delete anything in your bucket.

Narrowing the grant to your prefix

To scope the policy tighter, set Resource to arn:aws:s3:::<your-bucket>/<your-path-prefix>/*. The dashboard generates the policy for you with your bucket and prefix already filled in, so if you set a prefix, copy its version.

Object ownership

cside delivers each object with a server-side copy from its own bucket into yours. Keep your bucket on Bucket owner enforced object ownership (ACLs disabled), which is the S3 default, so your account owns the delivered objects and can read them.

Create the export in the dashboard

Open the dashboard, go to Settings > Device Intelligence, and select New export. Fill in the form:

Domain Scope: every domain, including ones you add later, or a subset you pick
S3 Bucket Name and Region: the bucket from step 1
Path Prefix (optional): the prefix from step 1
Format: JSONL or Parquet

cside names the export for you, from the scope and the bucket. Once you save, daily files start landing under your prefix. From the same tab you can pause an export with its toggle, edit it, or delete it.

The Device Intelligence export and the security alert S3 export write from the same cside IAM role and need the same s3:PutObject grant, so a single AllowCsideNotificationExport statement scoped to the whole bucket covers both.

They are two independent destinations, each with its own bucket, region, and optional prefix, so you can point them at one bucket or at separate ones. Their files never collide: alerts are written as alerts-team-<team_id>-<from>-<to>.csv, evaluations under cside-fingerprints/team=<team_id>/dt=<YYYY-MM-DD>/. Prefixes organize the objects, they are not what keeps the two exports apart.

Record structure

Every line is a JSON object with a set of top-level identity fields plus nested objects for each signal group:

Object	Description
`fingerprint`	The device fingerprint (browser, hardware, rendering, and environment signals).
`network_client_metrics`	TCP and TLS characteristics of the connection.
`ip_enrichment`	ASN, geo, and privacy data derived from the visitor IP.
`geo_lite_city_data`	City-level geolocation for the visitor IP.
`vpn_evaluation`	VPN likelihood and supporting signals.
`bot_evaluation`	Bot likelihood, verdict, and supporting signals.
`fingerprint_enrichment`	Signals derived from the fingerprint, such as disposable email detection.
`rule_evaluations`	Named rule outcomes evaluated for this visit.
`behavior`	In-page behavioral signals for the session: JavaScript API hooks, untrusted event count, and agent detection. Present when behavioral data was collected, otherwise `null`.

Absent keys mean default values

A field appears only when it has a non-default value. A missing key means the value was empty, false, 0, or not collected. When you parse the file, treat an absent key as a default, not an error.

Top-level fields

Field	Type	Description
`evaluation_id`	string	Unique ID for this evaluation.
`customer_id`	string	Your domain’s cside ID.
`customer_domain`	string	The domain being evaluated.
`team_id`	string	Your cside team ID.
`timestamp`	string	Evaluation time, ISO 8601.
`page_url`	string	The page where the evaluation was triggered.
`session_id`	string	Browser session ID.
`request_id`	string	Upstream request correlation ID.
`client_ip`	string	Visitor IP address.
`user_agent`	string	Visitor browser user agent.
`device_id`	string	Stable device identifier derived from the collected signals. Also present inside the `fingerprint` object.
`is_bot`	boolean	Whether the visitor was classified as a bot. The full verdict is in `bot_evaluation`.
`bot_agent_id`	string	Identified bot, when known (for example `google-googleother`).
`is_vpn`	boolean	Whether the visitor was classified as using a VPN. The full verdict is in `vpn_evaluation`.
`vpn_probability`	number	VPN likelihood from 0 to 1.
`vpn_confidence`	number	Confidence in the VPN classification from 0 to 1.
`vpn_reasons`	string[]	Human-readable reasons for the VPN classification.
`device_fingerprint`	string	Compact device fingerprint token (base64).
`threat_fingerprint`	string	Compact threat fingerprint token (base64).

`fingerprint` object

The device fingerprint is the largest object. The tables below group its fields by category.

Identity

Field	Type	Description
`device_id`	string	Stable device identifier derived from the collected signals.

Browser and system

Field	Type	Description
`product`	string	Browser `navigator.product` value.
`product_sub`	string	Browser `navigator.productSub` value.
`browser_name`	string	Browser name.
`browser_version`	string	Browser version.
`mobile`	boolean	Whether the browser reports as mobile.
`apple_pay_version`	number	Apple Pay API version, when available.
`user_agent`	string	Browser user agent string.
`plugins`	string[]	Installed browser plugins.
`platform`	string	Operating system platform.
`cpu_architecture`	string	Reported CPU architecture.
`hardware_architecture`	number	Hardware architecture indicator.
`connection`	string	Network connection type (for example `4g`).

Rendering (Canvas, WebGL, WebGPU)

Field	Type	Description
`canvas_signal`	string	Canvas rendering signal.
`webgl_signal`	string	WebGL rendering signal.
`webgl_vendor`	string	WebGL vendor string.
`webgl_renderer`	string	WebGL renderer string.
`video_card_vendor`	string	GPU vendor.
`video_card_renderer`	string	GPU renderer.
`video_card_vendor_unmasked`	string	Unmasked GPU vendor, when available.
`video_card_renderer_unmasked`	string	Unmasked GPU renderer, when available.
`video_card_version`	string	GPU driver version string.
`video_card_shading_language_version`	string	Shading language version.
`webgpu_supported`	boolean	Whether WebGPU is supported.
`webgpu_adapter`	string	WebGPU adapter description.
`webgpu_signal`	string	WebGPU rendering signal.

Locale and time

Field	Type	Description
`timezone`	string	Reported time zone.
`locale`	string	Reported locale.
`languages`	string[]	Accepted languages.

Audio

Field	Type	Description
`audio_signal`	string	Audio fingerprint signal.
`audio_max_channels`	number	Maximum audio output channels.
`audio_channel_count_mode`	string	Audio channel count mode.

Hardware

Field	Type	Description
`device_memory`	number	Reported device memory in GB.
`hardware_concurrency`	number	Number of logical CPU cores.
`js_heap_size_limit`	number	JavaScript heap size limit in bytes.
`math_values`	object	Results of math precision probes, keyed by operation.

Screen

Field	Type	Description
`screen_width`	number	Screen width in pixels.
`screen_height`	number	Screen height in pixels.
`screen_resolution`	string	Screen resolution string.
`color_depth`	number	Screen color depth.
`device_pixel_ratio`	number	Device pixel ratio.
`touch_support`	boolean	Whether touch input is supported.
`max_touch_points`	number	Maximum simultaneous touch points.
`media_matches`	string[]	Matched CSS media queries.

Browser APIs

Field	Type	Description
`online_status`	boolean	Whether the browser reports as online.
`do_not_track`	string	Do Not Track setting.
`cookies_enabled`	boolean	Whether cookies are enabled.
`media_devices`	string[]	Available media device kinds.
`indexeddb_support`	boolean	IndexedDB support.
`localstorage_support`	boolean	localStorage support.
`sessionstorage_support`	boolean	sessionStorage support.
`bluetooth_support`	boolean	Web Bluetooth support.
`geolocation_support`	boolean	Geolocation API support.
`device_motion_support`	boolean	Device motion support.
`device_orientation_support`	boolean	Device orientation support.
`speech_recognition_support`	boolean	Speech recognition support.
`vibration_support`	boolean	Vibration API support.
`gamepad_support`	boolean	Gamepad API support.
`fullscreen_support`	boolean	Fullscreen API support.
`clipboard_support`	boolean	Clipboard API support.
`service_worker_support`	boolean	Service Worker support.
`webassembly_support`	boolean	WebAssembly support.

Preferences

Field	Type	Description
`prefers_dark_mode`	boolean	Prefers dark color scheme.
`prefers_reduced_motion`	boolean	Prefers reduced motion.

Fonts

Field	Type	Description
`detected_fonts`	string[]	Fonts detected on the device.
`font_metrics`	object	Font rendering metrics, keyed by measurement.

Network signals

Field	Type	Description
`stun_ips`	string[]	IP addresses from the visitor’s WebRTC candidates, usually the public address reported by the STUN server. Often empty: browsers mask local addresses, and WebRTC is not always available.
`permission_states`	object	Permission states, keyed by permission name.

WebRTC, speech, and MathML

Field	Type	Description
`webrtc_supported`	boolean	WebRTC support.
`webrtc_hash`	string	Hash of the WebRTC feature set.
`webrtc_details`	object	Detailed WebRTC capabilities.
`webrtc_error`	string	WebRTC probe error, when one occurred.
`speech_synthesis_supported`	boolean	Speech synthesis support.
`speech_hash`	string	Hash of the speech synthesis voice set.
`speech_details`	object	Detailed speech synthesis data.
`speech_error`	string	Speech probe error, when one occurred.
`mathml_supported`	boolean	MathML support.
`mathml_hash`	string	Hash of MathML rendering.
`mathml_details`	object	Detailed MathML rendering data.
`mathml_error`	string	MathML probe error, when one occurred.

Performance and battery

Field	Type	Description
`fps`	number	Measured frames per second.
`battery_info`	object	Battery state: `charging`, `level`, `charging_time`, `discharging_time`.

Incognito detection

Field	Type	Description
`incognito_detected`	boolean	Whether a private browsing mode was detected.
`incognito_support`	string	Detection method support level.
`incognito_method`	string	Detection method used.
`incognito_quota_bytes`	number	Storage quota observed during detection.

Developer tools detection

Field	Type	Description
`developer_tools_detected`	boolean	Whether developer tools appear to be open.
`developer_tools_support`	string	Detection support level.
`developer_tools_method`	string	Detection method used.
`developer_tools_gap_px`	number	Window gap in pixels used for detection.

Virtual machine detection

Field	Type	Description
`virtual_machine_detected`	boolean	Whether the device appears to be a virtual machine.
`virtual_machine_support`	string	Detection support level.
`virtual_machine_reason`	string	Reason the device was flagged.

Automation and tampering

Field	Type	Description
`web_driver`	boolean	Whether `navigator.webdriver` is set.
`web_driver_tampered`	boolean	Whether the webdriver flag appears tampered.
`cdp`	boolean	Chrome DevTools Protocol usage detected.
`cdp_tampered`	boolean	Whether CDP signals appear tampered.
`tamper_injected_globals`	string[]	Suspicious injected global variables.
`tamper_expose_binding_leak`	boolean	Binding leak associated with automation.
`tamper_desc_instance_own`	string[]	Anomalous own property descriptors.
`tamper_desc_proto_nonnative`	string[]	Non-native prototype descriptors.
`tamper_xrealm_webdriver_mismatch`	boolean	Cross-realm webdriver mismatch.
`tamper_xrealm_renderer_delta`	boolean	Cross-realm renderer difference.
`tamper_probe_blocked`	boolean	Whether tamper probes were blocked.

Device attestation

Field	Type	Description
`device_uvpaa`	boolean	User-verifying platform authenticator available.
`device_client_caps_count`	number	Count of reported client capabilities.
`device_caps_uvpa`	boolean	Platform authenticator capability.
`device_apple_pay_active_card`	boolean	Apple Pay has an active card.
`device_payment_enrolled`	boolean	Device is enrolled in a payment method.
`device_serial_present`	boolean	Serial capability present.
`device_hid_present`	boolean	HID capability present.
`device_notif_static`	string	Static notification capability signal.
`device_notif_queried`	string	Queried notification capability signal.
`device_realness_probe_error`	boolean	Whether a realness probe errored.

DRM

Field	Type	Description
`drm_probed`	boolean	Whether DRM support was probed.
`drm_clearkey`	boolean	Clear Key support.
`drm_widevine`	boolean	Widevine support.
`drm_widevine_robustness`	string	Widevine robustness level.
`drm_externalclearkey`	boolean	External Clear Key support.
`drm_fairplay`	boolean	FairPlay support.
`drm_playready`	boolean	PlayReady support.
`drm_hw_secure_all`	boolean	Hardware-secure decoding support.
`drm_ua_brand_is_google_chrome`	boolean	UA brand claims Google Chrome.
`drm_error`	string	DRM probe error, when one occurred.
`drm_elapsed_ms`	number	DRM probe duration in milliseconds.

Client-provided tags

Field	Type	Description
`external_ids`	object	Identifiers you attached to the fingerprint, such as `accountId`, `orderId`, or `email`.
`extension_presence_results`	object	Detected browser extensions, keyed by extension.

`network_client_metrics` object

Connection-level TCP and TLS characteristics.

Field	Type	Description
`client_ip`	string	Visitor IP address.
`client_port`	number	Visitor source port.
`user_agent`	string	User agent seen at the network layer.
`js_timezone`	string	Time zone reported by JavaScript.
`timestamp`	string	Time the network sample was taken, ISO 8601.
`request_id`	string	Request ID at the network layer.
`protocol`	string	HTTP protocol used.
`quic_version`	number	QUIC version, when the connection used QUIC.
`syn_ip_ttl`	number	IP TTL from the initial SYN packet.
`syn_window_size`	number	TCP window size from the initial SYN.
`syn_window_scale`	number	TCP window scale from the initial SYN.
`tcp_rtt_usec`	number	Estimated TCP round-trip time in microseconds.
`tcp_rttvar_usec`	number	TCP round-trip time variance.
`tcp_rtt_min_usec`	number	Minimum observed TCP round-trip time.
`tcp_timestamp`	number	TCP timestamp option value.
`tcp_mss_syn`	number	Advertised TCP MSS.
`tcp_mss_rcv`	number	Observed TCP MSS from the peer.
`tls_handshake_usec`	number	TLS handshake duration in microseconds.
`tls_clienthello_size`	number	ClientHello size in bytes.
`tls_sni_format`	string	SNI extension format.
`tls_alpn_protocols`	string[]	ALPN protocols offered in the TLS handshake.
`tls_clienthello_ciphers`	number[]	Offered cipher suites.
`tls_clienthello_extensions`	number[]	Offered TLS extensions.
`tls_clienthello_signature_algs`	number[]	Offered signature algorithms.
`tls_clienthello_legacy_version`	number	ClientHello legacy version.
`tls_clienthello_supported_versions`	number[]	Offered TLS versions.
`tls_ja4`	string	JA4 TLS client fingerprint.
`matched_against`	string	Domain the connection was matched against.
`team_id`	string	Your cside team ID.

`ip_enrichment` object

Data derived from the visitor IP address.

Field	Type	Description
`asn`	number	Autonomous System Number.
`asn_name`	string	ASN organization name.
`asn_network`	string	ASN network range.
`asn_type`	string	ASN type, such as `hosting` or `isp`.
`city_name`	string	City name.
`country_code`	string	Country code.
`country_name`	string	Country name.
`latitude`	number	Latitude.
`longitude`	number	Longitude.
`postal_code`	string	Postal code.
`region_code`	string	Region code.
`region_name`	string	Region name.
`timezone`	string	Time zone.
`hosting`	boolean	IP belongs to a hosting provider.
`proxy`	boolean	IP is a known proxy.
`relay`	boolean	IP is a private relay.
`tor`	boolean	IP is a Tor exit node.
`vpn`	boolean	IP is a known VPN.
`service`	string	Named privacy service, when identified.
`maxmind_asn`	number	ASN from MaxMind.
`is_datacenter_ip`	boolean	IP is in a datacenter range.
`is_likely_datacenter`	number	Datacenter likelihood score.

`geo_lite_city_data` object

City-level geolocation.

Field	Type	Description
`city_name`	string	City name.
`country_code`	string	Country code.
`country_name`	string	Country name.
`latitude`	number	Latitude.
`longitude`	number	Longitude.
`postal_code`	string	Postal code.
`region_code`	string	Region code.
`region_name`	string	Region name.
`timezone`	string	Time zone.

`vpn_evaluation` object

VPN likelihood and supporting signals.

Field	Type	Description
`is_vpn`	boolean	Whether the visitor is classified as using a VPN.
`vpn_probability`	number	VPN likelihood from 0 to 1.
`vpn_confidence`	number	Confidence in the classification from 0 to 1.
`reasons`	string[]	Human-readable reasons for the classification.
`features`	object	Numeric signals used for the classification.
`context`	object	Enrichment context such as reverse DNS hostname, ASN, and geo.

`bot_evaluation` object

Bot likelihood and verdict.

Field	Type	Description
`is_bot`	boolean	Whether the visitor is classified as a bot.
`bot_probability`	number	Bot likelihood from 0 to 1.
`bot_confidence`	number	Confidence in the classification from 0 to 1.
`bot_agent_id`	string	Identified bot, when known (for example `google-googleother`).
`reasons`	string[]	Human-readable reasons for the classification.
`session_event_count`	number	Number of behavioral events processed for the session.
`model_1_score`	number	Score from the first bot model (fingerprint and network signals).
`model_1_threshold`	number	Decision threshold applied to the first model score.
`model_2_score`	number	Score from the second bot model (behavioral signals).
`model_2_threshold`	number	Decision threshold applied to the second model score.
`features`	object	Numeric signals used for the classification.

`fingerprint_enrichment` object

Field	Type	Description
`throwaway_email_detected`	boolean	Whether an attached email uses a disposable domain.

`rule_evaluations` object

Field	Type	Description
`rules`	object[]	Named rule outcomes. Each entry has `slot`, `rule_id`, `result`, `metadata`, and `computed_at`.

`behavior` object

In-page behavioral signals for the session. The whole object is null when no behavioral data was collected for the evaluation, so you can tell “no agent detected” apart from “no behavioral data”.

Field	Type	Description
`start_time`	number	Start of the behavioral observation window.
`end_time`	number	End of the behavioral observation window.
`page_urls`	string[]	Pages seen during the session’s behavioral window.
`js_hooks`	object[]	Trapped built-in JavaScript APIs. Each entry has `key` (the hooked function, such as `eval`, `fetch`, `function_bind`, `script_create`, or `node_append_child`), `initializer` (what installed the hook), and `count` (how many times it fired).
`untrusted_event_count`	number	Number of DOM events reported with `isTrusted` set to false, a common automation signal.
`agent_detected`	boolean	Whether any sample in the session was flagged as an automated agent.

Example record

A single record, formatted here for readability. In the file, each record is one line.

{
  "evaluation_id": "289076244130249728",
  "customer_id": "7371466449724252160",
  "customer_domain": "shop.example.com",
  "team_id": "7196353823991660544",
  "timestamp": "2026-04-21T17:53:19.378Z",
  "page_url": "https://shop.example.com/checkout",
  "client_ip": "203.0.113.42",
  "user_agent": "Mozilla/5.0 ... Chrome/124.0 Safari/537.36",
  "device_id": "fp_dev_5c8e21",
  "is_bot": false,
  "is_vpn": false,
  "fingerprint": {
    "device_id": "fp_dev_5c8e21",
    "browser_name": "Chrome",
    "browser_version": "124.0.0.0",
    "platform": "MacIntel",
    "timezone": "America/Los_Angeles",
    "languages": ["en-US", "en"],
    "screen_width": 1512,
    "screen_height": 982,
    "device_memory": 8,
    "external_ids": { "orderId": "txn_9931" }
  },
  "network_client_metrics": {
    "client_ip": "203.0.113.42",
    "tls_ja4": "t13d1516h2_8daaf6152771_b186095e22b6"
  },
  "geo_lite_city_data": {
    "country_code": "US",
    "city_name": "San Francisco",
    "latitude": 37.7749,
    "longitude": -122.4194
  },
  "ip_enrichment": { "asn": 13335, "asn_name": "CLOUDFLARENET", "hosting": false },
  "vpn_evaluation": { "is_vpn": false, "vpn_probability": 0.04 },
  "bot_evaluation": { "is_bot": false, "bot_probability": 0.07 },
  "behavior": {
    "start_time": 1776793999000,
    "end_time": 1776794011000,
    "page_urls": ["https://shop.example.com/checkout"],
    "js_hooks": [{ "key": "eval", "initializer": "inline", "count": 2 }],
    "untrusted_event_count": 0,
    "agent_detected": false
  }
}