# ITDR and activity log

> Monitor authentication anomalies in the console with ITDR: real-time feed, how to read the risk report, risk levels, report history, and activity log.

URL: https://docs.ironchip.com/en/identidad/administracion/itdr/

The ITDR (Identity Threat Detection and Response) module in the console is an intrusion detection system: it monitors authentication attempts and detects anomalous patterns, from warnings to fraud detection. Each anomaly produces a report with the type of anomaly, the date it occurred, and the affected user.

Download the PDF manual (in Spanish): [ITDR](https://7745202.fs1.hubspotusercontent-na1.net/hubfs/7745202/04-itdr-directorio-cuenta.pdf).

## What ITDR detects

ITDR detects, for example, repeated failed logins, attempts from unusual locations, and behavior that falls outside the user's historical profile. You can configure alert rules and automatic blocking.

Risk rules are described in [Policies and dynamic rules](https://docs.ironchip.com/en/identidad/conceptos/politicas/), and downloading events is covered in [ITDR event export](https://docs.ironchip.com/en/identidad/administracion/exportacion-de-eventos/).

## Open the event feed

1. In the main menu of the console, click **ITDR** to open the module.

   [Image: ITDR entry in the main menu of the console]

2. Click **Realtime feed** to see, as they happen, the events analyzed by the fraud engine.

   [Image: Realtime feed option inside the ITDR menu]

3. On the event you want to investigate, click **Options** to show the available actions. On the right, the **Transaction details** panel summarizes the event: the user, the location, the device (whether it is rooted, emulated, or debugged), the network analysis (country, VPN, TOR, proxy, and hosting), and the associated fraud cases.

   [Image: Realtime feed with the Options button of an event and the Transaction details panel]

4. Click **View report** to open the detailed report of the event, or **Block user** to block the user if you detect suspicious behavior.

   [Image: View report option in the Options menu of the event]

Besides **Realtime feed**, the **ITDR** menu includes **Threat analysis** (with the **Confirmed** and **Suspected** views), **Ruleset**, and **Toolset**.

## Read the report

The report is organized in blocks, and each one gives a different perspective on the same event.

### Risk assessment

**Risk assessment** shows the overall verdict Ironchip calculates for the analyzed action (registration, login, transaction, and so on), based on the system's confidence level.

[Image: Risk assessment block of the report]

### Detected fraud info

This block contains the written analysis of the case: which pattern was detected and why the event was flagged as suspicious or fraudulent.

[Image: Block with the detected fraud info]

### Location details

This block shows the location information associated with the event.

[Image: Block with the location details]

### Device details

This block includes the device integrity information that arrives through the Ironchip SDK, such as signs of Fake GPS or a rooted or jailbroken device.

[Image: Block with the device details]

### Threat intelligence

**Threat intelligence** provides additional context about the device, the user, or the location that may be relevant when you investigate the case.

[Image: Threat intelligence block]

### Risk assessment levels

Ironchip classifies each analyzed action into one of these four levels:

| Level          | Meaning                                                                                           |
| -------------- | ------------------------------------------------------------------------------------------------- |
| `fraud`        | Ironchip considers the action fraudulent and part of a confirmed fraud.                           |
| `high_risk`    | The action is potentially fraudulent. Preventive measures are recommended.                        |
| `low_risk`     | Ironchip considers the action performed by the device to be safe.                                 |
| `unknown_risk` | Ironchip doesn't have enough evidence to issue an accurate assessment at the time of the request. |

## Review the report history

1. Click **Back to reports** to leave the individual report and return to the general list.

   [Image: Detailed event report with the Back to reports button]

2. Click **All time** to see all available reports, with no date restriction.

   [Image: All time selector]

3. To narrow the list to a specific period, for example when you investigate a particular incident, use the date filter.

   [Image: Date filter of the reports list]

4. To investigate a user, filter the list by their email address.

   [Image: Email filter]

## Activity log

Besides ITDR, the console keeps a complete, auditable log of all the actions administrators take in the console and of all user authentication events. It records who signed in, when, from which location, to which service, and whether access was granted or denied. These logs are the basis of the evidence for ENS, NIS2, ISO 27001, and PCI DSS audits.

For more information, see [Monitoring](https://docs.ironchip.com/en/identidad/administracion/monitorizacion/).