The Dashboard

Your abuse operations center, where you monitor user behavior, investigate suspicious activity, and manage alerts from a single interface. Everything you need to understand the health of your user base is here.

Home Page

The home page gives you key metrics at a glance. Four stat cards show your total tracked identities, identities active in the last 24 hours, identities scored in the last 24 hours, and total events in the last 24 hours. These numbers tell you how much activity Dregs is processing and how fresh your scoring data is.

Below the stats, score distribution charts show how your user base breaks down across all four scoring dimensions — Humanity, Authenticity, Uniqueness, and Behavior. A healthy user base clusters toward high scores. If you see a growing tail of low scores in any dimension, that tells you where to focus your attention.

The recently active identities table rounds out the home page, showing users who have been active most recently. Each row shows the identity, their scores, and when they were last seen. This is a quick way to spot-check activity without running a search.

Identities

The Identities page is where you spend the most time during investigations. It lists every tracked user with their scores visible at a glance. Browse the full list, or narrow it down using search and filters to find exactly who you are looking for.

Each identity in the list shows a compact summary: the user identifier, display name and email if available, and the four dimension scores as colored indicators. You can sort by any score dimension to surface the most suspicious users first.

Clicking an identity opens the full detail view, which is organized into several sections:

• Overview — the identity's scores, badges, and key metadata at a glance.
• Scores and observations — a breakdown of every analyzer's output for this identity, showing exactly why each score is what it is. Each observation includes a confidence level and a plain-language explanation.
• Devices — every device this identity has used, with fingerprint details, IP addresses, and geolocation. Critical for understanding whether one person is using multiple devices or whether multiple accounts share one device.
• Related identities — other users linked to this identity through shared devices, similar names, similar emails, or overlapping behavior patterns. This is where you uncover duplicate accounts and coordinated abuse.
• Events — the full event history for this identity, showing every tracked action in chronological order.
• Reviews — LLM-powered identity reviews that provide a narrative assessment of the user's risk profile.

Devices

The Devices page lists every fingerprinted device Dregs has seen. Each entry shows the device fingerprint, IP address, geolocation (city and country), user agent, and which identities have used it.

Devices are a key investigative tool. When you see a single device associated with multiple identities, that is a strong signal of duplicate accounts because it means someone signed up repeatedly with different email addresses on the same machine. The device detail view shows this mapping clearly.

For more on how fingerprinting works, see Devices.

Events

The Events page is your real-time activity stream. Every tracked action — page views, form submissions, custom events — appears here in reverse chronological order. This is where you go when you need to understand exactly what a user did and when they did it.

Filter by event type, identity, device fingerprint, or free text to narrow down to the activity you care about. Click any event to see the full payload, including all tracked data fields. For incident investigations, the Events page is indispensable: it gives you a precise timeline of every action a suspicious user took.

Alerts

The Alerts page is your triage center. Summary cards at the top show counts of open, acknowledged, and closed alerts so you can gauge the current workload at a glance.

Below the summary, the alert list shows each alert with its severity, the identity that triggered it, and which rule it matched. Filter by status, severity, or identity to focus on what matters most. As you investigate, acknowledge alerts to signal that someone is looking at them, and close them when the issue is resolved or determined to be benign.

For details on configuring the rules that generate alerts, see Alerts.

Search and Filtering

The Events, Identities, and Devices pages share a unified search bar that supports both free text and structured filters. Just start typing to search, or use key:value syntax for precise filtering.

Some examples:

• humanity:0-50 — identities with a Humanity score between 0 and 50
• identity:user@example.com — events or devices associated with a specific identity
• authenticity:0-30 behavior:0-30 — identities that score low on both Authenticity and Behavior
• Plain text without a prefix searches across relevant fields for the current page

Score range filters are particularly powerful. Instead of scrolling through hundreds of identities, you can instantly surface users in a specific risk band — for example, everyone with a Uniqueness score below 25.

Settings

The Settings page is where you configure everything that controls how Dregs operates for your account:

• Team — invite members, manage roles, view pending invitations
• Credentials — manage API key pairs, allowed origins, and enable/disable status
• Badges — define badge rules that automatically label identities based on score thresholds
• Alerts — configure alert rules and notification channels
• Datasets — create and manage custom lookup tables for scoring enrichment

Most settings require admin or trainer privileges. See Team Management for details on roles and permissions.