Reviewing a Fingerprint Session

Every Device Intelligence session has a detail page in the dashboard with Overview, Location, and Identity graph tabs. This page covers what the Overview tab shows: the security checks run against the session, the raw signals cside captured, and a timeline of the session’s browser events.

To open a session, go to the cside dashboard and select a session from the fingerprint list.

Security checks

The Security Checks section runs a set of detections against the session. Expand any row to see the evidence behind its verdict instead of a raw score.

Core detections:

• VPN
• Proxy
• Bot / Agents
• Virtual Machine
• Incognito
• Dev Tools
• Tampering

A second group, fingerprint signals, reports the browser-level checks behind the identification: Canvas fingerprint, WebGL consistency, WebGPU supported, Real font set, Media devices present, Audio fingerprint, and STUN IPs.

Expanding a row shows structured evidence:

• VPN shows a confidence score against a threshold marker, a verdict (“VPN detected” or “Not VPN”), and the reasons behind a non-zero score.
• Bot / Agents shows a “Bot detected” verdict plus up to three model scores (a fingerprint-based model and two behavioral models, including a cursor-movement model), along with the session and cursor-evaluation counts behind them.
• Virtual Machine shows the detection method’s support and reason, plus a separate flag for a known VM or software-renderer GPU string. That flag is a supporting signal, not the verdict on its own.
• Incognito, Dev Tools, Tampering, and Proxy each show the detection method and the specific signals it checked, for example WebDriver and CDP tampering under Dev Tools, or hosting, datacenter, and Tor exit node signals under Proxy.

Captured metadata

Below Security Checks, the Captured metadata section is the full-evidence view for a session, replacing the old raw “Show JSON” modal. It groups every captured signal into cards:

Card	Contents
TCP / TLS handshake	Low-level connection and handshake telemetry
Network	Network-level verdict and reasoning
Permission states	Browser permission states, such as camera and geolocation
Browser capabilities	Feature support detected in the browser
Session identifiers	IDs tying the session together
Detected fonts	Fonts available to the browser
Rendering & comms signals	Rendering and communication-channel signals
Automation flags	Signals associated with browser automation
Bot model signals	Feature values behind the bot model score (shown only when a feature vector was captured)
Plugins & extensions	Detected browser plugins and extensions

The section header shows how many signals were captured out of roughly 250 possible. A card with nothing for the session shows a plain “not captured” message instead of an empty table.

Events timeline

The Events timeline is a chronological, grouped feed of everything that happened during the session: clicks, scrolls, keystrokes, paste, focus changes, page-lifecycle events (page load, visibility change, before unload), mouse movement, and detected JS-hook usage.

Consecutive events of the same kind are grouped into a single row, and scroll events collapse into one row per direction (“Scroll down” / “Scroll up”) that tracks the total elapsed time. Idle periods and keystroke bursts are summarized rather than listed event-by-event, for example “Idle period · 4s” or “Keystrokes · 12 keys”.

Some rows carry an extra insight badge:

• JS hook detected — a built-in browser API (eval(), fetch(), a script tag being created, a node being inserted) was invoked from a script context with no real originating URL.
• Untrusted event — the event’s isTrusted flag was false, meaning a script dispatched it rather than a real user action.
• Bot cursor detected — the most recent mouse-movement window before that row was scored as bot-like by the cursor-verification model. This appears on the mouse-move row and can include the model’s score.

The displayed page URL has its query string stripped; the rest of the path, including any org or team IDs it contains, is shown as-is.

Related pages

• Device Intelligence
• Retrieving datapoints
• Events API