Event Categories
When EventType is suspicious_activity, the EventCategory will be one of the following values, indicating the specific signal detected.
| EventSubType | EventCategory | Description |
|---|---|---|
ai | ai_crawler | Detects AI crawler bots that collect training data or index web content. Learn More |
ai | ai_assistant | Detects AI assistants that browse the web on behalf of a user during a chat session. Learn More |
ai | ai_agent | Detects autonomous AI agents that browse websites, fill forms, and complete tasks without direct human control. Learn More |
fraud | credential_pair | Detects credential stuffing patterns where an email and password are pasted together into a single input field. Learn More |
fraud | disposable_email | Detects email addresses entered in form fields that belong to known disposable or temporary email services. Learn More |
fraud | multiple_emails | Detects sessions where multiple distinct email addresses are submitted through forms. Learn More |
fraud | sql_injection | Detects SQL injection attempts in form inputs and URLs. Learn More |
fraud | xss | Detects cross-site scripting (XSS) attempts in form inputs and URLs. Learn More |
automation | no_pointer_movement | Detects sessions where no mouse movement occurs despite other interactions being present. Learn More |
automation | no_pointer_curve | Detects sessions where mouse movement consists only of straight-line jumps with no natural curved motion. Learn More |
automation | no_user_activity | Detects page visits with no user interaction—no clicks, form changes, or other user-initiated events. Learn More |
automation | full_page_resize | Detects when the browser viewport is resized to match the full document height, a technique commonly used by bots to capture full-page screenshots. Learn More |
automation | headless_browser | Detects headless browser environments through User-Agent strings, viewport dimensions, and known automation tool signatures. Learn More |
network | network_cloud | Detects page requests originating from known cloud provider IP address ranges. Learn More |
network | network_consumer_private | Detects page requests originating from consumer privacy-preserving network services, such as Apple Private Relay. Learn More |
network | ai_vendor | Detects traffic originating from known AI vendor IP address ranges. Learn More |