App Instance ID View

From the Table View, click on an app instance for the App Instance ID view. This view shows detailed information about the instance, its detected events, and the levels of risk posed by those events.

The top of the view shows whether the instance is Active or Suspended, and the app instance ID.

The Timeline of Calculation indicates the points in time when the instance gained an increase in its total risk level due to risky detections. Risk levels do not decrease over time. Hover over the timeline for details of risk level changes.

Filter events by threat type or risk level in the Events column dropdown.

Select a detection event (low, suspicious, or high risk) to see a description of the event and guidance on whether suspension or other action is warranted.

Suspend an active instance by selecting Response > Suspend App Instance in the lower right corner.

Unsuspend a suspended instance by selecting Response > Unsuspend App Instance in the lower right corner.

Navigate to the next or previous app instance ID view using the side arrows.