Data Explorer
Explore mobile sessions, understand the signals behind decisions, and investigate connections between users, devices, and networks—all within the Analyst Portal.
Find the sessions that need a closer look
The Data Explorer brings your workspace’s mobile attestation evaluations into a searchable view. Each evaluation records the integrity check associated with a protected action in your app. Analysts can review when it happened, the user reference, the decision, detected signals, device and operating-system context, and available network information without rebuilding that context across separate tools.
Start with a user, IP address, evaluation ID, or signal of interest. Narrow the results by time range, iOS or Android, SDK release, decision, and processing status. The activity chart shows how evaluations and decisions change over time; selecting an interval filters the table to that period. A sudden increase in blocked sessions becomes a focused set of records to investigate.
Understand the signals behind a decision
Open an evaluation to inspect its findings and available signal explanations alongside its device, OS, app, SDK release, and network context. A runtime manipulation finding calls for a different investigation from an unfamiliar device profile. Seeing the specific observations helps your team understand why the activity received attention and what to verify next.
Processing status matters too. An evaluation awaiting analysis is different from a completed result, and network evidence can still be pending. The portal preserves that distinction so analysts can assess the evidence available at the time of review. Comparing results across releases and platforms can also help separate a broader attack pattern from a change introduced by an app or SDK rollout.
Follow the connections between users, devices, and networks
A flagged evaluation is a starting point. Its user history shows earlier activity, decisions, and observed device and location changes within the available history. Analysts can examine when a pattern began, whether suspicious findings recur, and how the current evaluation compares with that user’s previous activity.
Search a relevant IP address to compare the accounts and evaluations using that network. Review device and OS context alongside timing and signals to investigate repeated profiles, account switching, or activity concentrated around the same infrastructure. These comparisons help your team assess whether an isolated event is part of a wider operation.
Connections need corroboration: a device model does not uniquely identify a physical device, and a shared IP can belong to a household, workplace, or mobile carrier. Use the history and integrity findings together, then bring the relevant evaluations into your case review. Cipherstep Agent and automated reports can support further investigation while your analysts decide what the evidence means.