In this section, the color scheme shown in the screenshots may differ from the actual appearance of the Control Centre.
In the Monitoring module group, you can find detailed information about all call attempts and fraud attacks, filter the relevant information, and/or download it as .csv/tsv files.
¶ All Call Attempts
This module provides information about all call attempts (including both fraudulent and non-fraudulent call attempts) that passed through the antifraud system. It is located on the left-hand side of the navigation menu under Monitoring.
The All Call Attempts module consists of the following parts:
- The filters for the bar chart and the table of call attempts;
- The bar chart of connected and non-connected call attempts (use the CHARTS button to change the displayed bar charts);
- The table of call attempts and the
DOWNLOAD button (for a .csv/tsv file of the filtered call attempts); - The Call Attempt Details page.
You can view this and any corresponding documentation page directly from the Control Centre by clicking the ? ABOUT button in the top-right corner of the page.
In order to find the needed call attempt events, you can use multiple filters in the top section of the page:
- Traffic Type: A dropdown list that allows you to select attempts, based on the traffic type (may not be displayed depending on your settings);
- Customer Name: A dropdown list that allows you to select attempts, based on the customer name (may not be displayed depending on your settings);
- Traffic Direction: A dropdown list that allows you to select attempts, based on the traffic direction (Inbound, Outbound; may not be displayed depending on your settings);
- Source Gateway: Filter attempts based on the originating gateway (e.g., the client's custom id). If the call information does not contain gateway information, the filter will not be displayed;
- Destination Gateway: Filter attempts based on the terminating gateway (e.g., the supplier's custom id). If the call information does not contain gateway information, the filter will not be displayed;
- A-number: Filter attempts based on the calling (source) number; the number or range should be entered manually;
- Source Network: A dropdown list, which allows you to choose call attempts, based on the source network; you can enter the network name manually;
- Source Country: A dropdown list, which allows you to choose call attempts, based on the source country; you can enter the country name manually;
- B-number: Filter attempts based on the called (destination) number; the number or range should be entered manually;
- Destination Network: A dropdown list, which allows you to choose call attempts, based on the destination network; you can enter the network name manually;
- Destination Country: A dropdown list, which allows you to choose call attempts, based on the destination country; you can enter the country name manually;
- Call ID: Filter attempts by the unique external identificator of the call attempt (i.e. the call ID provided by the client);
- Connection Status: A dropdown list, which allows you to filter attempts by their connection status (Connected, Non-connected);
- Call Duration (min): A dropdown list, which allows you to filter attempts by duration of the call in minutes (choose one of the suggested intervals);
- Call Duration (sec): A dropdown list, which allows you to filter attempts by duration of the call in seconds (choose one of the suggested intervals);
- Disconnect Code: Filter attempts by their disconnect code;
- Disconnect Initiator: A dropdown list, which allows you to filter attempts by their disconnect initiator (A, B, L);
- Started At (Date and Time Range): You can select the time range for displaying call attempts by choosing one of the suggested intervals from the dropdown list (Last 24 hours, Last 7 days, Last 30 days, etc.) or specifying a custom interval.
You can remove a filter by hovering over it and clicking the x (cross) symbol next to it or by clicking the RESET button, which will remove all previously selected filters.
Clicking the customize button 
allows you to customize your filters. After selecting the needed filter parameters click the SAVE button to apply changes, or click the RESET button to revert the changes to the previous setup. Click the CANCEL button to cancel the changes and exit the pop-up window.
All filters affect the connected and non-connected call attempts bar chart below them. This chart visualizes the number of connected and non-connected call attempts according to the selected filters.
If you hover over the widget bar (for a specific time period), the following data will be displayed:
- The selected time period;
- The amount of all call attempts;
- The amount of connected call attempts;
- The amount of non-connected call attempts (attempts rejected due to subscribers' actions, blockages, invalid numbers, routing errors and other reasons).
You can customize the charts layout by clicking the CHARTS button in the right top corner of the page. You can select Connected & Non-connected Call Attempts bar chart and All Volume bar chart. You can drag the = button next to the chart name to change its placement on the page.
All filters affect the all volume bar chart. This chart visualizes the amount of total volume according to the selected filters.
If you hover over the widget bar (for a specific time period), the following data will be displayed:
- The selected time period;
- The total volume amount.
You can download the filtered call attempts by clicking the DOWNLOAD button above the call attempts table. In the download prompt window, you can choose the file format (csv or tsv), the separator (semicolon, comma, or tab), and the needed columns (by clicking the separate COLUMNS tab).
You can then filter the data in the downloaded file using an application of your choice (e.g., MS Excel) for a more detailed analysis.
In the downloaded file you can find the following fields for call attempts:
- Call Attempt ID: A unique internal identifier of the call attempt (i.e. the call ID assigned by the antifraud system);
- Call ID: A unique external identificator of the call attempt (i.e. the call ID assigned by the client);
- Traffic Type: The traffic category (Carrier, Enterprise; may not be displayed depending on your settings);
- Customer Name: The source (originating) operator (may not be displayed depending on your settings);
- Traffic Direction: The direction of the traffic (Inbound, Outbound; may not be displayed depending on your settings);
- Source Gateway: The originating gateway (e.g., the client's custom id). If the call information does not contain gateway information, the field will not be displayed;
- Destination Gateway: The terminating gateway (e.g., the supplier's custom id). If the call information does not contain gateway information, the field will not be displayed;
- A-number: The calling (source) number in E.164 format;
- Source Network: The calling (originating) network name;
- Source Country: The calling (originating) country ISO code;
- B-number: The called (destination) number in E.164 format;
- Destination Network: The called (terminating) network name;
- Destination Country: The called (terminating) country ISO code;
- Duration: The duration of the call in HH:MM:SS format;
- Disconnect Code: The reason the connection ended indicated by a SIP response code;
- Disconnect Initiator: The party that ended the call attempt;
- From: The caller number set by the device or network that originates the call (may not be displayed depending on your settings);
- PAI: P-Asserted-Identity, the caller's phone number in the standard E.164 format, set by the originating network after verifying the caller's identity (may not be displayed depending on your settings);
- Redirecting Number: The number from which a call diversion or transfer was invoked (may not be displayed depending on your settings);
- Connection Status: The status of the call (Connected,Non-connected);
- Setup Time (UTC): The timestamp that records when the call attempt was initiated in UTC time-zone;
- Connect Time (UTC): The timestamp that records when the call attempt successfully connected in UTC time-zone;
- Disconnect Time (UTC): The timestamp that records when the call attempt was disconnected in UTC time-zone.
All filters affect the table of all call attempts below the bar chart.
By default, each call attempt event in the table includes the following details: A-number, source name, B-number, destination name, call duration in HH:MM:SS format, and the date and time of the start of the call. But you can also add the following columns: traffic type, customer name, traffic direction, source gateway, destination gateway, disconnect code, disconnect initiator, from, PAI, redirecting number, call ID, connection status, and the timestamps of the calls' connection and disconnection.
To customize the columns, click the button above the table. Here you can add (or remove) the needed columns by ticking (or unticking) the box on the left, or change the order of columns in the table by holding down the = button and moving the corresponding column up or down. After customizing the columns click the SAVE button to apply the changes, or click the RESET button to revert the changes to the previous setup. Click the CANCEL button to cancel the changes and exit the pop-up window.
Clicking the add widget button 
above the table or above the bar chart will take you to the New Widget page. This allows you to quickly convert existing views into Dashboard widgets. The system pre-fills: data source, widget type, filters, columns (for the tables). You must select the target dashboard and the target widget group. This functionality is further detailed in the Dashboard module.
You can click on the LOAD MORE button at the bottom of the page to find more call attempt events.
You can learn more about a particular call attempt event by clicking on it. You will be taken to the Call Attempt Details page.
This page consists of the following fields:
- Call Attempt ID: A unique internal identifier of the call attempt (i.e. assigned by the antifraud system), which can be copied by clicking the Copy button on the right;
- Call ID: A unique external identificator of the call attempt (i.e. assigned by the client), which can be copied by clicking the Copy button on the right;
- Traffic Type: The traffic category (Carrier, Enterprise; may not be displayed depending on your settings);
- Customer Name: The source (originating) operator (may not be displayed depending on your settings);
- Traffic Direction: The direction of the traffic (Inbound, Outbound; may not be displayed depending on your settings);
- Source Gateway: The originating gateway identificator (optional field: if the call information does not contain gateway information, this field will not be displayed);
- Destination Gateway: The terminating gateway identificator (optional field: if the call information does not contain gateway information, this field will not be displayed);
- A-number: The calling (source) number;
- Source: The source country and network;
- B-number: The called (destination) number;
- Destination: The destination country and network;
- Duration: The duration of the call in HH:MM:SS format;
- Disconnect Code: The reason the connection ended indicated by a SIP response code;
- Disconnect Initiator: The party that ended the call attempt;
- From: The caller number set by the device or network that originates the call (may not be displayed depending on your settings);
- PAI: P-Asserted-Identity, the caller's phone number in the standard E.164 format, set by the originating network after verifying the caller's identity (may not be displayed depending on your settings);
- Redirecting Number: The number from which a call diversion or transfer was invoked (may not be displayed depending on your settings);
- Setup Time (UTC): The timestamp that records when the call attempt was initiated in UTC time-zone;
- Connect Time (UTC): The timestamp that records when the call attempt successfully connected in UTC time-zone;
- Disconnect Time (UTC): The timestamp that records when the call attempt was disconnected in UTC time-zone.
¶ Fraud Call Attempts
This module provides information about all call attempts detected, rejected or broken by the antifraud system. It is located on the left-hand side of the navigation menu under Monitoring.
The Fraud Call Attempts module consists of the following parts:
- The filters for the bar chart and the table of fraudulent call attempts;
- The bar chart of rejected, broken and detected fraudulent call attempts (use the CHARTS button to change the displayed bar charts);
- The table of fraudulent call attempts and the DOWNLOAD button (for a .csv/tsv file of the filtered fraudulent call attempts);
- The Fraud Call Attempt Details page.
You can view this and any corresponding documentation page directly from the Control Centre by clicking the ? ABOUT button in the top-right corner of the page.
In order to find the needed fraudulent call attempt events, you can use multiple filters in the top section of the page:
- Traffic Type: A dropdown list that allows you to select attempts, based on the traffic type (may not be displayed depending on your settings);
- Customer Name: A dropdown list that allows you to select attempts, based on the customer name (may not be displayed depending on your settings);
- Traffic Direction: A dropdown list that allows you to select attempts, based on the traffic direction (Inbound, Outbound; may not be displayed depending on your settings);
- Source Gateway: Filter results based on the originating gateway (e.g., the client's custom id). If the call information does not contain gateway information, the filter will not be displayed;
- Destination Gateway: Filter results based on the terminating gateway (e.g., the supplier's custom id). If the call information does not contain gateway information, the filter will not be displayed;
- Event Type: A dropdown list that allows you to select attempts by the type of action applied (Rejected, Broken, Detected, and Non-rejected);
- Fraud Type: A dropdown list that allows you to specify the fraud type (PBX Hacking, Wangiri, Spam/Scam Calls and others);
- Fraud Probability: A dropdown list that allows you to filter attempts by their estimated probability of being fraudulent (90–99%, 99–99.9%, 99.9–99.99%, and greater than 99.99%);
- Importance: A dropdown list that allows you to select attempts by their importance level (set manually for custom rules);
- Method: A dropdown list that allows you to narrow the results, based on the protection methods used (Proactive Monitoring, Behavioral Analysis, Custom Rules, and Block List);
- Rule ID: A dropdown list that allows you to choose call attempts, based on the applied Custom rule;
- A-number: Filter attempts based on the calling (source) number; the number or range should be entered manually;
- Source Network: A dropdown list that allows you to choose call attempts, based on the source network; you can enter the network name manually;
- Source Country: A dropdown list that allows you to choose call attempts, based on the source country; you can enter the country name manually;
- B-number: Filter attempts based on the called (destination) number; the number or range should be entered manually;
- Destination Network: A dropdown list that allows you to choose call attempts, based on the destination network; you can enter the network name manually;
- Destination Country: A dropdown list that allows you to choose call attempts, based on the destination country; you can enter the country name manually;
- Call ID: Filter attempts by the unique external identificator of the call attempt (i.e. the call ID provided by the client);
- Connection Status: A dropdown list, which allows you to filter attempts by their connection status (Connected, Non-connected);
- Call Duration (min): A dropdown list, which allows you to filter attempts by duration of the call in minutes (choose one of the suggested intervals);
- Call Duration (sec): A dropdown list, which allows you to filter attempts by duration of the call in seconds (choose one of the suggested intervals);
- Disconnect Code: Filter attempts by their disconnect code;
- Disconnect Initiator: A dropdown list, which allows you to filter attempts by their disconnect initiator (A, B, L);
- Started At (Date and Time Range): You can select the time range for displaying call attempts by choosing one of the suggested intervals from the dropdown list (Last 24 hours, Last 7 days, Last 30 days, etc.) or specifying a custom interval;
- Detected At (Date and Time Range): You can select the time range for displaying detected call attempts by choosing one of the suggested intervals from the dropdown list (Last 24 hours, Last 7 days, Last 30 days, etc.) or specifying a custom interval.
You can remove a filter by hovering over it and clicking the x (cross) symbol next to it or by clicking the RESET button, which will remove all previously selected filters.
Clicking the customize button allows you to customize your filters. After selecting the needed filter parameters click the SAVE button to apply changes, or click the RESET button to revert the changes to the previous setup. Click the CANCEL button to cancel the changes and exit the pop-up window.
All filters affect the fraudulent call attempts bar chart below them. This chart visualizes the number of fraud call attempts according to the selected filters.
If you hover over a widget bar (for a specific time period), the following data will be displayed:
- The selected time period;
- The amount of all fraudulent call attempts;
- The amount of rejected fraudulent call attempts;
- The amount of broken fraudulent call attempts;
- The amount of detected fraudulent call attempts, which were necessary to identify an attack;
- The amount of non-rejected fraudulent call attempts.
You can customize the charts layout by clicking the CHARTS button in the right top corner of the page. You can select Fraud Call Attempts bar chart, Fraud Call Attempts % bar chart, and Fraud Charge. You can drag the = button next to the chart name to change its placement on the page.
All filters affect the Fraud Call Attempts % bar chart. This chart visualizes the fraud call attempts according to the selected filters.
If you hover over the widget bar (for a specific time period), the following data will be displayed:
- The total percentage of fraudulent call attempts (relative to the value of all call attempts);
- The percentage of rejected fraudulent call attempts relative to the value of all call attempts;
- The percentage of broken fraudulent call attempts relative to the value of all call attempts;
- The percentage of detected (but not rejected or broken) fraudulent call attempts, which were necessary to identify an attack relative to the value of all call attempts;
- The percentage of non-rejected fraudulent call attempts relative to the value of all call attempts.
All filters affect the Fraud Charge bar chart. This chart visualizes the amount of fraud charge according to the selected filters.
If you hover over the widget bar (for a specific time period), the following data will be displayed:
- The total amount of fraud charge in the US dollars;
- The total amount of fraud charge prevented by the antifraud system in the US dollars;
- The total amount of fraud charge not prevented by the antifraud system in the US dollars.
You can download the filtered fraudulent call attempts by clicking the DOWNLOAD button above the fraud call attempts table. In the download prompt window, you can choose the file format (csv or tsv), the separator (semicolon, comma, or tab), and the needed columns (by clicking the separate COLUMNS tab).
You can then filter the data in the downloaded file using an application of your choice (e.g., MS Excel) for a more detailed analysis.
In the downloaded file you can find the following fields with fraud call attempt details:
- Call Attempt ID: A unique internal identifier of the call attempt (i.e. assigned by the antifraud system);
- Call ID: A unique external identificator of the call attempt (i.e. assigned by the client);
- Event Type: The type of action applied: rejected, broken or suspicious (not rejected and not broken) fraudulent call attempt;
- Fraud Type: The type of fraud identified by the system displayed as an ID, for the full list of all fraud types see the Information module;
- Fraud Probability: The estimated probability that the call attempt is fraudulent, expressed as a percentage;
- Importance: Importance level (set manually for custom rules);
- Method: The protection method used (PROACTIVE refers to Proactive Monitoring, BEHAVIORAL refers to Behavioral Analysis, CUSTOM refers to Custom Rules, BLOCKLIST refers to Block List);
- Rule ID: The ID of the applied Custom rule;
- Traffic Type: The traffic category (Carrier, Enterprise; may not be displayed depending on your settings);
- Customer Name: The source (originating) operator (may not be displayed depending on your settings);
- Traffic Direction: The direction of the traffic (Inbound, Outbound; may not be displayed depending on your settings);
- Source Gateway: The originating gateway (e.g., the client's custom id). If the call information does not contain gateway information, the field will not be displayed;
- Destination Gateway: The terminating gateway (e.g., the supplier's custom id). If the call information does not contain gateway information, the field will not be displayed;
- A-number: The calling (source) number in E.164 format;
- Source Network: The calling (originating) network name;
- Source Country: The calling (originating) country ISO code;
- B-number: The called (destination) number in E.164 format;
- Destination Network: The called (terminating) network name;
- Destination Country: The called (terminating) country ISO code;
- Duration: The duration of the call in HH:MM:SS format;
- Disconnect Code: The reason the connection ended indicated by a SIP response code;
- Disconnect Initiator: The party that ended the call attempt;
- Prevented Charge (USD): The total amount of prevented fraud charge the US dollars (to learn more about how the Fraud Charge is calculated, see the Calculations section on the Information page);
- Non-prevented Charge (USD): The total amount of non-prevented fraud charge in the US dollars (to learn more about how the Fraud Charge is calculated, see the Calculations section on the Information page);
- From: The caller number set by the device or network that originates the call (may not be displayed depending on your settings);
- PAI: P-Asserted-Identity, the caller's phone number in the standard E.164 format, set by the originating network after verifying the caller's identity (may not be displayed depending on your settings);
- Redirecting Number: The number from which a call diversion or transfer was invoked (may not be displayed depending on your settings);
- Connection Status: The status of the call (Connected,Non-connected);
- Setup Time (UTC): The timestamp that records when the call attempt was initiated in UTC time-zone;
- Connect Time (UTC): The timestamp that records when the call attempt successfully connected in UTC time-zone;
- Disconnect Time (UTC): The timestamp that records when the call attempt was disconnected in UTC time-zone;
- Fraud Detected at (UTC): The date and time of the fraudulent call attempt detection in UTC time-zone.
All filters affect the table of fraud call attempts below the bar chart.
By default, each fraudulent call attempt event in the table includes the following details: event type, fraud type, fraud probability, importance (for custom rules), A-number, source name, B-number, destination name, duration HH:MM:SS format, prevented charge, non-prevented charge, and the date and time of the start of the call. But you can also add the following columns: method, rule ID, traffic type, customer name, traffic direction, source gateway, destination gateway, disconnect code, disconnect initiator, from, PAI, redirecting number, call ID, connection status, the timestamps of the calls' connection and disconnection, and the timestamp of the call detection.
To customize the columns, click the button above the table. Here you can add (or remove) the needed columns by ticking (or unticking) the box on the left, or change the order of columns in the table by holding down the = button and moving the corresponding column up or down. After customizing the columns click the SAVE button to apply the changes, or click the RESET button to revert the changes to the previous setup. Click the CANCEL button to cancel the changes and exit the pop-up window.
For a brief description of the detected fraud type, hover over the 
symbol.
Clicking the add widget button above the table or above the bar chart will take you to the New Widget page. This allows you to quickly convert existing views into Dashboard widgets. The system pre-fills: data source, widget type, filters, columns (for the tables). You must select the target dashboard and the target widget group. This functionality is further detailed in the Dashboard module.
You can click on the LOAD MORE button at the bottom of the page to find more fraudulent call attempt events.
You can learn more about a particular fraudulent call attempt event by clicking on it. You will be taken to the Fraud Call Attempt Details page.
This page consists of three tabs:
- The INFO tab contains the general call information;
- The ATTACKS tab contains the Related Fraud Attacks table;
- The BLOCKAGES tab contains the Related Active Blockages table.
This INFO tab consists of the following fields:
- Call Attempt ID: A unique internal identifier of the call attempt (i.e. assigned by the antifraud system), which can be copied by clicking the Copy button on the right;
- Call ID: A unique external identificator of the call attempt (i.e. assigned by the client), which can be copied by clicking the !Copy button on the right;
- Event Type: The type of action applied;
- Fraud Type: The type of fraud identified by the system; you can hover over the icon for a brief description of the fraud type;
- Fraud Probability: The estimated probability that the call attempt is fraudulent, expressed as a percentage;
- Importance: Importance level (set manually for custom rules);
- Method: The protection method used;
- Rule ID: The ID of the applied rule (for custom rules, clicking the rule ID will take you to the corresponding View Custom Rule page);
- Traffic Type: The traffic category (Carrier, Enterprise; may not be displayed depending on your settings);
- Customer Name: The source (originating) operator (may not be displayed depending on your settings);
- Traffic Direction: The direction of the traffic (Inbound, Outbound; may not be displayed depending on your settings);
- Source Gateway: The originating gateway identificator (optional field: if the call information does not contain gateway information, this field will not be displayed);
- Destination Gateway: The terminating gateway identificator (optional field: if the call information does not contain gateway information, this field will not be displayed);
- A-number: The calling (source) number;
- Source: The calling (source) country and network;
- B-number: The called (destination) number;
- Destination: The called (destination) country and network;
- Duration: The duration of the call in HH:MM:SS format;
- Disconnect Code: The reason the connection ended indicated by a SIP response code;
- Disconnect Initiator: The party that ended the call attempt;
- From: The caller number set by the device or network that originates the call (may not be displayed depending on your settings);
- PAI: P-Asserted-Identity, the caller's phone number in the standard E.164 format, set by the originating network after verifying the caller's identity (may not be displayed depending on your settings);
- Redirecting Number: The number from which a call diversion or transfer was invoked (may not be displayed depending on your settings);
- Setup Time (UTC): The timestamp that records when the call attempt was initiated in UTC time-zone;
- Connect Time (UTC): The timestamp that records when the call attempt successfully connected in UTC time-zone;
- Disconnect Time (UTC): The timestamp that records when the call attempt was disconnected in UTC time-zone;
- Detected at: The date and time of detection.
The ATTACKS tab consists of the Related Fraud Attacks table. You can customize the columns by clicking the button above the table. Here you can add (or remove) the needed columns by ticking (or unticking) the box on the left, or change the order of columns in the table by holding down the = button and moving the corresponding column up or down. After customizing the columns click the SAVE button to apply the changes, or click the RESET button to revert the changes to the previous setup. Click the CANCEL button to cancel the changes and exit the pop-up window.
Clicking an attack in the table will take you to the related Fraud Attack Details page.
The BLOCKAGES tab consists of the Related Active Blockages table. You can customize the columns by clicking the button above the table. Here you can add (or remove) the needed columns by ticking (or unticking) the box on the left, or change the order of columns in the table by holding down the = button and moving the corresponding column up or down. After customizing the columns click the SAVE button to apply the changes, or click the RESET button to revert the changes to the previous setup. Click the CANCEL button to cancel the changes and exit the pop-up window.
Clicking a blockage in the table will take you to the related Active Blockage Details page.
¶ Fraud Attacks
This module provides information about all fraud attacks detected or blocked by the antifraud system. It is located on the left-hand side of the navigation menu under the module Fraud Call Attempts.
Fraud Attacks module consists of the following parts:
- The filters for the bar chart and the table of fraud attacks;
- The bar chart for detected and blocked fraud attacks;
- The table of fraud attacks and the download button (for a .csv/tsv file of the filtered fraud attacks);
- The Fraud Attack Details page.
You can view this and any corresponding documentation page directly from the Control Centre by clicking the ? ABOUT button in the top-right corner of the page.
In order to find the needed fraud attack events, you can use multiple filters in the top section of the page:
- Event Type: A dropdown list that allows you to select attacks by the type of action applied: Block attack or Non-blocked attack;
- Fraud Type: A dropdown list that allows you to specify the fraud type (PBX Hacking, Wangiri, Spam/Scam Calls and others);
- Fraud Probability: A dropdown list that allows you to filter attacks by their estimated probability of being fraudulent (90–99%, 99–99.9%, 99.9–99.99%, and greater than 99.99%);
- Reason for Detection: A dropdown list that allows you to filter attacks by the reasons that caused the system to flag the attack (suspicious statistics and/or abnormal patterns);
- Importance: A dropdown list that allows you to select attacks by their importance level (set manually for custom rules);
- Method: A dropdown list that allows you to narrow the results, based on the protection methods used (Behavioral Analysis, Proactive Monitoring, Custom Rule);
- Rule ID: A dropdown list that allows you to choose call attacks, based on the applied Custom rule;
- Traffic Type: A dropdown list that allows you to select attacks, based on the traffic type (may not be displayed depending on your settings);
- Customer Name: A dropdown list that allows you to select attacks, based on the customer name (may not be displayed depending on your settings);
- Traffic Direction: A dropdown list that allows you to select attacks, based on the traffic direction (Inbound, Outbound; may not be displayed depending on your settings);
- Source Gateway: Filter results based on the originating gateway (e.g., the client's custom id). If the call information does not contain gateway information, the filter will not be displayed;
- Destination Gateway: Filter results based on the terminating gateway (e.g., the supplier's custom id). If the call information does not contain gateway information, the filter will not be displayed;
- A-range: Filter attempts based on the calling (source) number range; the number range should be entered manually;
- Source Network: A dropdown list that allows you to choose call attempts, based on the source network; you can enter the network name manually;
- Source Country: A dropdown list that allows you to choose call attempts, based on the source country; you can enter the country name manually;
- B-range: Filter attempts based on the called (destination) number range; the number range should be entered manually;
- Destination Network: A dropdown list that allows you to choose call attempts, based on the destination network; you can enter the network name manually;
- Destination Country: A dropdown list that allows you to choose call attempts, based on the destination country; you can enter the country name manually;
- Detected At (Date and Time Range): You can select the time range for displaying detected attacks by choosing one of the suggested intervals from the dropdown list (Last 24 hours, Last 7 days, Last 30 days, etc.) or specifying a custom interval.
You can remove a filter by hovering over it and clicking the x (cross) symbol next to it or by clicking the RESET button, which will remove all previously selected filters.
Clicking the customize button allows you to customize your filters. After selecting the needed filter parameters click the SAVE button to apply the changes, or click the RESET button to revert the changes to the previous setup. Click the CANCEL button to cancel the changes and exit the pop-up window.
All filters affect the fraud attacks bar chart below. This chart visualizes the number of fraud attacks according to the selected filters.
When you hover over a widget bar (for a specific time period), the following data is displayed:
- The selected time period;
- The total amount of fraud attacks;
- The amount of blocked fraud attacks;
- The amount of non-blocked (but detected) fraud attacks.
You can download the filtered fraud attacks by clicking the DOWNLOAD button above the fraud attacks table. In the download prompt window, you can choose the file format (csv or tsv), the separator (semicolon, comma, or tab), and the needed columns (by clicking the separate COLUMNS tab).
You can then filter the data in the downloaded file using an application of your choice (e.g., MS Excel) for a more detailed analysis.
In the downloaded file you can find the following fields with fraud attack details:
- Fraud Attack ID: The identificator of the fraud attack;
- Fraud Detected at (UTC): The date and time of the fraud attack detection in UTC time-zone;
- Traffic Type: The traffic category (Carrier, Enterprise; may not be displayed depending on your settings);
- Customer Name: The source (originating) operator (may not be displayed depending on your settings);
- Traffic Direction: The direction of the traffic (Inbound, Outbound; may not be displayed depending on your settings);
- Source Gateway: The originating gateway (e.g., the client's custom id). If the call information does not contain gateway information, the field will not be displayed;
- Destination Gateway: The terminating gateway (e.g., the supplier's custom id). If the call information does not contain gateway information, the field will not be displayed;
- A-range: The calling (source) number range of the attack (one of the possible variants of the A-side in a fraud attack, along with Source Network and Source Country, this information is used for fraud blockages);
- Source Network: The called (originating) network name (one of the possible variants of the A-side in a fraud attack, along with A-range and Source Country, this information is used for fraud blockages);
- Source Country: The source country ISO code (one of the possible variants of the A-side in a fraud attack, along with A-range and Source Network, this information is used for fraud blockages);
- B-range: The called (destination) number range of the attack (one of the possible variants of the A-side in a fraud attack, along with Destination Network and Destination Country, this information is used for fraud blockages);
- Destination Network: The destination network name (one of the possible variants of the B-side in a fraud attack, along with B-range and Destination Country, this information is used for fraud blockages);
- Destination Country: The destination country ISO code (one of the possible variants of the B-side in a fraud attack, along with B-range and Destination Network, this information is used for fraud blockages);
- Event Type: The type of action applied: blocked attack or detected attack (not blocked attack);
- Fraud Type: The type of fraud identified by the system displayed as an ID, for the full list of all fraud types see the Information module;
- Fraud Probability: The estimated probability that the attack is fraudulent, expressed as a percentage;
- Reason for Detection: The reasons that caused the system to flag the attack (suspicious statistics and/or abnormal patterns);
- Importance: Importance level (set manually for custom rules);
- Method: The protection method used for the fraud attack detection (PROACTIVE refers to Proactive Monitoring, BEHAVIORAL refers to Behavioral Analysis, CUSTOM refers to Custom Rules);
- Rule ID: The ID of the applied rule (this information can be helpful if custom rules are used);
- Fraud Charge (USD): The total financial amount (in USD) of the fraudulent traffic that was detected (but not prevented) and prevented;
- Fraud Call Attempts: The total number of call attempts associated with the detected fraud attack;
- Prevented Fraud Charge (USD): The financial amount (in USD) of fraudulent traffic that was successfully prevented;
- Rejected Fraud Call Attempts: The number of fraudulent call attempts that were rejected by the system;
- Rejected Fraud Call Attempts %: The percentage of rejected fraud call attempts out of the total fraud call attempts;
- Broken Fraud Call Attempts: The number of fraudulent call attempts broken by the system while they were active (connected);
- Broken Fraud Call Attempts %: The percentage of broken fraud call attempts out of the total fraud call attempts;
- Detected Fraud Call Attempts: The total number of fraudulent call attempts which caused the fraud attack's identification (these call attempts were not rejected or broken);
- Detected Fraud Call Attempts %: The percentage of detected fraud call attempts out of the total traffic or total fraud attempts;
- Non-rejected Fraud Call Attempts: The number of fraudulent call attempts that were not rejected;
- Non-rejected Fraud Call Attempts %: The percentage of non-rejected fraud call attempts out of the total fraud call attempts;
- Non-prevented Fraud Charge (USD): The financial amount (in USD) of fraudulent traffic that was not prevented (i.e., the loss incurred);
- Non-prevented Fraud Volume (min): The total amount of fraud duration (in minutes) that the system has detected but not prevented;
- Non-prevented Fraud Calls: The total amount of connected fraud call attempts (with non-zero duration) that the system has detected but not prevented;
- Non-prevented Fraud ACD (min): The average call duration (in minutes) of connected fraud call attempts that the system has detected but not prevented;
- Non-prevented Fraud ASR (%): The answer seizure ratio (in %) of fraudulent traffic that the system has detected but not prevented.
By default, each fraud attack event includes the following details: type of action applied, fraud type, fraud probability, importance (for custom rules), A-number range, source name, B-number range, destination name, fraud charge, the number of fraud attempts, and date and time of detection. But you can also add the following columns: reason for detection, detection method, rule ID, traffic type, customer name, traffic direction, source gateway, destination gateway, prevented charge, rejected attempts, rejected attempts percentage, broken attempts, broken attempts percentage, detected attempts, detected attempts percentage, non-rejected attempts, non-rejected attempts percentage, non-prevented charge, non-prevented volume, non-prevented calls, non-prevented ACD, and non-prevented ASR.
To customize the columns, click the button above the table. Here you can add (or remove) the needed columns by ticking (or unticking) the box on the left, or change the order of columns in the table by holding down the = button and moving the corresponding column up or down. After customizing the columns click the SAVE button to apply the changes, or click the RESET button to revert the changes to the previous setup. Click the CANCEL button to cancel the changes and exit the pop-up window.
For a brief description of the detected fraud type, hover over the icon.
Clicking the add widget button above the table or above the bar chart will take you to the New Widget page. This allows you to quickly convert existing views into Dashboard widgets. The system pre-fills: data source, widget type, filters, columns (for the tables). You must select the target dashboard and the target widget group. This functionality is further detailed in the Dashboard module.
You can click on the LOAD MORE button at the bottom of the page to see more fraud attack events.
You can learn more about a particular fraud attack event by clicking on it. You will be taken to the Fraud Attack Details page.
This page consists of the BLOCK / UNBLOCK button, a set of widgets, and three tabs:
- The INFO tab contains the general call information;
- The CALL ATTEMPTS tab contains the Related Fraud Call Attempts table;
- The BLOCKAGES tab contains the Related Active Blockages table.
At the top right of the page, you can find the BLOCK / UNBLOCK button. If the attack is not currently blocked - you will see the BLOCK button, if the attack is currently blocked - you will see the UNBLOCK button.
The Fraud Charge, Fraud Call Attempts and Non-prevented Fraud widgets display key statistics for the specific attack:
- Prevented and Non-Prevented Charge for the attack;
- The amount of Rejected, Broken, Detected, and Non-rejected fraudulent call attempts;
- The total Volume amount, amount of Calls, ACD, and ASR of Non-prevented fraudulent call attempts respectively.
This INFO tab consists of the following sections:
- General. This section includes the following information:
- Fraud Attack ID: The unique event ID, which can be copied by clicking the
button on the right; - Event Type: The type of action applied;
- Blockage Status: The current state of the fraud attack with respect to blocking, indicating whether the attack (and its associated calls) was blocked or not blocked by the system;
- Fraud Type: The type of fraud identified by the system, where you can hover over the symbol for a brief description of the fraud type;
- Fraud Probability: The estimated probability that the attack is fraudulent, expressed as a percentage;
- Reason for Detection: The reasons that caused the system to flag the attack (the inforamtion may be used as the reasons for trouble ticketing). Up to top 3 reasons may be displayed from the following list:
- Abnormal A-number pattern. Suspicious structure of A-numbers in call attempts: all call attempts originate from one or a few A-numbers; the last digits of A-numbers are iterated sequentially, etc.
- Abnormal B-number pattern. Suspicious structure of B-numbers in call attempts: all call attempts go to one or a few B-numbers; the last digits of B-numbers are iterated sequentially, etc.
- Abnormal call timestamps pattern. Suspicious structure of call timestamps (Setup Time, Connect Time, Disconnect Time, etc.). For example, all call attempts started at the same time; many simultaneous calls, etc.
- Abnormal disconnection pattern. Suspicious pattern in call attempt disconnection (in the Disconnect Code and Disconnect Initiator fields).
- High call charge. High charge per call or high charge for the traffic volume overall.
- Short or zero-duration calls. Suspicious amount of very short or zero-duration calls.
- Suspicious ACD. Suspicious Average Call Duration value (typical of the detected fraud type).
- Suspicious ASR. Suspicious Answer Seizure Ratio value (typical of the detected fraud type).
- Suspicious call duration pattern. Suspicious call durations: identical, unnaturally distributed, etc.
- Suspicious time-of-day activity. Suspicious day of the week or time of the call. For example, Friday evening, nighttime, etc.
- Suspicious traffic amount. Suspicious traffic volume (either too high or too low).
- Traffic spike. A traffic spike observed in Call Attempts, Connected Calls, or Total Duration. - Importance: Importance level (set manually for custom rules);
- Method: The protection method used;
- Rule ID: The ID of the applied rule (for custom rules, clicking the rule ID will take you to the corresponding View Custom Rule page);
- Detected at: The date and time of detection.
- Fraud Attack ID: The unique event ID, which can be copied by clicking the
- Scope. This section includes the following information:
- A-range: The calling (source) side, which can contain a number range, a country, or a network;
- Source: The calling (source) side, which can contain a country name, a network name, and a network type;
- B-range: The called (destination) side, which can contain a number range, a country, or a network.
- Destination: The called (destination) side, which can contain a country name, a network name, and a network type.
- Description: The description of the fraud attack event and the action taken in response to it.
The CALL ATTEMPTS tab consists of the Related Fraud Call Attempts table. You can customize the columns by clicking the button above the table. Here you can add (or remove) the needed columns by ticking (or unticking) the box on the left, or change the order of columns in the table by holding down the = button and moving the corresponding column up or down. After customizing the columns click the SAVE button to apply the changes, or click the RESET button to revert the changes to the previous setup. Click the CANCEL button to cancel the changes and exit the pop-up window.
Clicking a call attempt in the table will take you to the related Fraud Call Attempt Details page, while the SHOW ALL button will take you to the Fraud Call Attempts page with the selected Fraud Attack ID and the fraudulent call attempts related to it.
The BLOCKAGES tab consists of the Related Active Blockages table. You can customize the columns by clicking the button above the table. Here you can add (or remove) the needed columns by ticking (or unticking) the box on the left, or change the order of columns in the table by holding down the = button and moving the corresponding column up or down. After customizing the columns click the SAVE button to apply the changes, or click the RESET button to revert the changes to the previous setup. Click the CANCEL button to cancel the changes and exit the pop-up window.
Clicking a blockage in the table will take you to the related Active Blockage Details page. You can also click the three dots 
on the right side of the blockage. There will be two options: 'View Fraud Call Attempts' (which will take you to the related Active Blockage Details page) and 'Unblock' (if the fraud management team decides that the blockage is unnecessary or excessive).
¶ Fraud Analytics
The Fraud Analytics module is designed to provide insights into fraudulent activities using the aggregated data. It can be used as a report constructor.
The Fraud Analytics module consists of the following parts:
- The GROUP BY field for selecting the main table groupings;
- The filters for the main data table and the DOWNLOAD button to export the filtered data as a .csv/tsv file;
- The main data table.
You can view this and any corresponding documentation page directly from the Control Centre by clicking the ? ABOUT button in the top-right corner of the page.
The data can be sorted by using the GROUP BY field. You can only select 4 groups at a time.
Click the GROUP BY field and select available options to group the data table accordingly. Fraud Type is selected by default. To remove a group, click the cross (x) icon next to it.
The following groups are available:
- Traffic Type: The traffic category (Carrier, Enterprise; may not be displayed depending on your settings);
- Customer Name: The source (originating) operator (may not be displayed depending on your settings);
- Traffic Direction: The direction of the traffic (Inbound, Outbound; may not be displayed depending on your settings);
- Source Gateway: The originating gateway (e.g., the client's custom id). If the call information does not contain gateway information, the option will not be displayed;
- Destination Gateway: The terminating gateway (e.g., the supplier's custom id). If the call information does not contain gateway information, the option will not be displayed;
- Source Country: The source country ISO code (one of the possible variants of the A-side in a fraud attack, along with A-range and Source Network, this information is used for fraud blockages);
- Destination Country: The destination country ISO code (one of the possible variants of the B-side in a fraud attack, along with B-range and Destination Network, this information is used for fraud blockages);
- Source Network: The called (originating) network name;
- Destination Network: The destination network name;
- A-number: The calling (source) number in E.164 format;
- B-number: The called (destination) number in E.164 format;
- Event Type: The type of action applied: blocked attack or detected attack (not blocked attack);
- Fraud Type: The type of fraud identified by the system displayed as an ID, for the full list of all fraud types see the Information module;
- Fraud Probability: The estimated probability that the attack is fraudulent, expressed as a percentage;
- Importance: Importance level (set manually for custom rules);
- Method: The protection method used for the fraud attack detection (PROACTIVE refers to Proactive Monitoring, BEHAVIORAL refers to Behavioral Analysis, CUSTOM refers to Custom Rules);
- Rule ID: The ID of the applied rule (this information can be helpful if custom rules are used).
You can use the followng filters to specify additional parameters in the main data table:
- Traffic Type: A dropdown list that allows you to select attempts, based on the traffic type (may not be displayed depending on your settings);
- Customer Name: A dropdown list that allows you to select attempts, based on the customer name (may not be displayed depending on your settings);
- Traffic Direction: A dropdown list that allows you to select attempts, based on the traffic direction (Inbound, Outbound; may not be displayed depending on your settings);
- Source Gateway: Filter results based on the originating gateway (e.g., the client's custom id). If the call information does not contain gateway information, the filter will not be displayed;
- Destination Gateway: Filter results based on the terminating gateway (e.g., the supplier's custom id). If the call information does not contain gateway information, the filter will not be displayed;
- Event Type: A dropdown list that allows you to select attempts by the type of action applied (Rejected, Broken, Detected, and Non-rejected);
- Fraud Type: A dropdown list that allows you to specify the fraud type (PBX Hacking, Wangiri, Spam/Scam Calls and others);
- Fraud Probability: A dropdown list that allows you to filter attempts by their estimated probability of being fraudulent (90–99%, 99–99.9%, 99.9–99.99%, and greater than 99.99%);
- Importance: A dropdown list that allows you to select attempts by their importance level (set manually for custom rules);
- Method: A dropdown list that allows you to narrow the results, based on the protection methods used (Proactive Monitoring, Behavioral Analysis, Custom Rules, and Block List);
- Rule ID: A dropdown list that allows you to choose call attempts, based on the applied Custom rule;
- A-number: Filter attempts based on the calling (source) number; the number or range should be entered manually;
- Source Network: A dropdown list that allows you to choose call attempts, based on the source network; you can enter the network name manually;
- Source Country: A dropdown list that allows you to choose call attempts, based on the source country; you can enter the country name manually;
- B-number: Filter attempts based on the called (destination) number; the number or range should be entered manually;
- Destination Network: A dropdown list that allows you to choose call attempts, based on the destination network; you can enter the network name manually;
- Destination Country: A dropdown list that allows you to choose call attempts, based on the destination country; you can enter the country name manually;
- Connection Status: A dropdown list, which allows you to filter attempts by their connection status (Connected, Non-connected);
- Disconnect Code: Filter attempts by their disconnect code;
- Disconnect Initiator: A dropdown list, which allows you to filter attempts by their disconnect initiator (A, B, L);
- Started At (Date and Time Range): You can select the time range for displaying call attempts by choosing one of the suggested intervals from the dropdown list (Last 24 hours, Last 7 days, Last 30 days, etc.) or specifying a custom interval.
Clicking the customize button allows you to customize your filters. After selecting the needed filter parameters click the SAVE button to apply the changes, or click the RESET button to revert the changes to the previous setup. Click the CANCEL button to cancel the changes and exit the pop-up window.
The main data table summarizes key statistics for different groupings.
The total number of entries is displayed above the table. You can click on the LOAD MORE button at the bottom of the page to see more entries.
You can download the filtered data by clicking the DOWNLOAD button. You can choose the file format (csv or tsv) and the separator (semicolon, comma, or tab). This functionality can be used for additional offline analysis or reporting.
If the total number of entries exceeds 1000 then only the first 1000 rows are displayed in the main table. But if you click the DOWNLOAD button you can find the total number of entries there.
In the downloaded file you can find the following fields:
- Source Country: The originating (calling) country in the ISO code format;
- Destination Country: The terminating (called) country in the ISO code format;
- Fraud Type: The type of fraud identified by the system displayed as an ID, for the full list of all fraud types see the Information module;
- Total Call Attempts: The number of all call attempts (both fraudulent and non-fraudulent);
- Fraud Charge (USD): The total financial amount (in USD) of the fraudulent traffic that was detected (but not prevented) and prevented. You can learn more about how Fraud Charge is calculated on the Calculations section of the Information page;
- Fraud Call Attempts: The number of call attempts identified as fraudulent;
- Fraud Call Attempts (%): The percentage of total call attempts that were identified as fraudulent relative to the value of all call attempts;
- Prevented Fraud Charge (USD): The estimated financial amount saved due to the prevention of fraudulent call attempts. You can learn more about how the Prevented Fraud Charge is calculated on the Calculations section of the Information page;
- Rejected Call Attempts: TThe number of fraudulent call attempts that were rejected by the system;
- Rejected Call Attempts (%): The percentage of fraudulent call attempts that were rejected relative to the value of all call attempts;
- Broken Fraud Call Attempts: The number of fraudulent call attempts broken by the system while they were active (connected);
- Broken Fraud Call Attempts (%): The percentage of broken fraud call attempts out of the total call attempts;
- Detected Fraud Call Attempts: The total number of fraudulent call attempts which caused the fraud attack's identification (these call attempts were not rejected or broken);
- Detected Fraud Call Attempts (%): The percentage of detected fraud call attempts out of the total call attempts;
- Non-rejected Fraud Call Attempts: The number of fraudulent call attempts that were not rejected;
- Non-rejected Fraud Call Attempts (%): The percentage of non-rejected fraud call attempts out of the total call attempts;
- Non-prevented Fraud Charge (USD): The financial amount (in USD) of fraudulent traffic that was not prevented (i.e., the loss incurred);
- Non-prevented Fraud Volume (min): The total amount of fraud duration (in minutes) that the system has detected but not prevented;
- Non-prevented Fraud Calls: The total amount of connected fraud call attempts (with non-zero duration) that the system has detected but not prevented.
By standard configuration, the main data table includes the following details: groups specified in the GROUP BY field, fraud attempts, fraud attempts percentage, fraud charge amount, number of rejected attempts, rejected attempts percentage, prevented charge amount. But you can also add the following columns: number of broken attempts, broken attempts percentage, number of detected attempts, detected attempts percentage, number of non-rejected attempts, non-rejected attempts percentage, non-prevented charge amount, non-prevented volume amount, number of non-prevented calls.
You can customize the table fields by clicking the button. After selecting the needed parameters click the SAVE button to apply the changes, or click the RESET button to revert the changes to the previous setup. Click the CANCEL button to cancel the changes and exit the pop-up window.
By default, data is sorted by Fraud Calls in descending order. You can change the sort order by clicking the desired column header. Clicking it twice will sort the table in ascending order. Click it a third time to reset the table to its default sort order. The current sort order is indicated by an upward or downward arrow.
Clicking the add widget button above the table will take you to the New Widget page. This allows you to quickly convert existing views into Dashboard widgets. The system pre-fills: data source, widget type, filters, columns (for the tables). You must select the target dashboard and the target widget group. This functionality is further detailed in the Dashboard module.
Clicking an entry in the table will take you to the Fraud Call Attempts page, filtered according to the data in the Fraud Analytics table, allowing you to view the calls related to the corresponding fraud attacks.
