Brand Protection

Detection Details

This is the deep end the full detail view of a single detection, and everything you can see or do with it.

5.1 Priority Levels

Every detection is tagged with a priority, shown as a small badge at the top of its detail view. There are five levels, from least to most urgent:

  • Low Priority
  • Medium Priority
  • High Priority
  • Critical Priority
  • Urgent Priority

5.2 Classification & Status

Two fields that are easy to mix up, so it's worth being clear on the difference:

  • Classification - what kind of threat this is (e.g., phishing, counterfeit).
  • Status - what's currently being done about it (e.g., in progress, resolved, needs legal action).

Classification answers "what is this," status answers "where are we with it."

5.3 Description, Reason & File Uploads

  • Description - details on exactly what's happening in this detection and why it's a threat to your organization. This is the plain English explanation of the problem.
  • Reason - explains why the detection currently has the status it has (e.g., why it's on-hold, why it needs legal action).
  • Upload File - you can attach supporting files to a detection (screenshots, evidence, correspondence, etc.) directly from this view.

How a detection gets created

Behind the scenes, every detection is built from a fairly simple set of fields, most of which are optional depending on what kind of threat it is:

  • identifier - a unique identifier for the detection
  • url - the link to the threat itself, if applicable
  • org - the organization the detection belongs to
  • id - internal ID
  • value - a general value field
  • threatScore - a numeric score indicating how threatening this detection is
  • meta - miscellaneous metadata
  • source - where the detection came from
  • keyword - the keyword/search term that surfaced it, if relevant
  • description - the plain-text description shown to users
  • attr - additional attributes
  • timestamp.created / timestamp.updated - when the detection was created and last updated

5.4 Additional Details & Intelligence

Beyond the core fields above, a detection can carry a lot of extra intelligence depending on what type of threat it is and what data was available when it was found. None of these fields are guaranteed to be present, they show up when they're relevant.

For example, a counterfeit product detection might include something like:

  • picture - an image of the listing
  • name - the product name as listed
  • seller_name - who's selling it
  • unit_sold - quantity/unit info
  • total_reviews - review count on the listing
  • platform - which marketplace it's on
  • country / city - where the seller is based, if known
  • seller_address / email - seller contact info, if available
  • platform_licence_number / gst - regulatory/registration info, if available
  • product_type - category of product
  • distribution_channel - how it's being sold (e.g., Online)
  • original_brand - the brand being infringed
  • product_rating - listing rating, if available
  • product_price - the price it's listed at

You can also manually update or add attributes to this Intelligence section, so if you find extra context that isn't automatically captured, you're not stuck waiting on the system.

5.5 Tags

Every detection carries a set of tags that summarize its current state at a glance. A typical tag set looks like this:

"severity": "urgent",
"source": "clean",
"status": "on_hold",
"priority": "high",
"classificationStatus": "done",
"autoClassifyConfidence": "high",
"classificationMethod": "ai_auto",
"classification": "phishing",
"infringement": "credential_harvesting_attack"

Breaking that down:

  • severity / priority - how urgent this detection is.
  • source - a flag related to where/how the detection was sourced.
  • status - the current lifecycle stage.
  • classificationStatus - whether classification is done, pending, etc.
  • autoClassifyConfidence - how confident the AI was in its auto-classification.
  • classificationMethod - whether the classification came from ai_auto or was ai_accepted by a human.
  • classification - the general type of threat (e.g., phishing).
  • infringement - the specific violation (e.g., credential harvesting attack).

5.6 Quick Links & Actions

What action buttons you see depends on what kind of detection you're looking at:

  • If it's a potential asset (something that might belong to you rather than being a threat), you'll only see two options: "Accept as an Asset" or "Reject."
  • Otherwise, if the detection is classifiable and you have permission, you'll see the full action set: Set Status, Request Takedown, Mark as Resolved, Reclassify Detection, and False Positive.

Every one of these buttons works by updating the detection's tags behind the scenes:

Action What it sets
Mark as resolved status: resolved
False positive status: false_positive
Update severity severity: <chosen value>
Request takedown status: takedown_in_progress
Add to asset status: whitelisted

So these buttons aren't doing anything mysterious, they're really just a friendly interface over updating the detection's tag values.

5.7 Maximum Severity

Clicking on the Maximum Severity control lets you change the priority of the threat, using the same five levels described earlier (Low, Medium, High, Critical, Urgent).

5.8 Auto-Classification (AI)

This section can be in one of two states:

Not Classified - you'll just see a "Run AI Classification" button.

Here's what happens when you run it:

  1. The detection's ID is sent to the backend.
  2. The backend confirms this is actually a valid detection before doing anything else.
  3. AI analyzes it and generates a classification, along with a confidence score.
  4. That confidence score is compared against a threshold -CONFIDENCE_THRESHOLD = 80.
    • If the score is above 80, the specific infringement is included in the result.
    • If it's 80 or below, the infringement is left out of what's shown, even though a classification was generated.

Classified - once classified, you'll see the confidence score, the predicted classification, and the infringement (if the confidence was high enough to include it). From here, there are two possible sub-states:

  • Pending acceptance -shows a "Re-classification" button and an "Accept" button, since a human hasn't reviewed it yet.
  • Rejected -simply shows the current classification as-is.

Accepting a classification does a bit more than just click a checkbox:

  1. The detection ID (and optionally a classification response ID) is sent to the backend.
  2. The system validates and retrieves the latest AI/Intelligent classification.
  3. The detection's tags are updated regardless of the original confidence score -because a human has now reviewed and approved it, so the confidence threshold no longer matters.
  4. classificationStatus is updated to "Done" and classificationMethod is updated to "ai_accepted".
  5. The detection and the original AI classification are both updated and marked as accepted.
  6. The action is logged for audit purposes before returning the result.

Clicking into a classification also lets you see the full breakdown behind it -things like the Classification Reasoning and the Question Responses that led the AI to its conclusion, so it's not a total black box.

5.9 AI Overview & Impact Assessment

The AI Overview gives you an AI-generated summary of the threat and its classification, and comes in three flavors:

  1. Custom prompt - you provide your own prompt, and the AI responds specifically to that.
  2. General analysis (no prompt provided) -the AI looks at the detection's data and tags and focuses on critical data patterns, the most urgent insights and trends, and high-priority risks. It returns:
    • A brief analysis of the critical findings.
    • The top 3 most urgent recommendations.
    • A confidence score.
    • A priority level.
    • The top 3 immediate actions you can take.
  3. Remediation -guidance specifically on how to remediate the issue.

Separately, the Impact Assessment covers the business impact and risk evaluation of the threat -essentially, "why should we care, and how much."

5.10 Collaboration (Tasks & Comments)

Every detection has a collaboration space where you can add tasks and comments to coordinate with your team on what needs to happen next.

Tasks:

  • View all tasks -fetches tasks by their ID, joins them with their related notification name, and returns a cleaned-up list.
  • Add task -when you create a task, the system fetches your organization info, generates a unique task ID, and automatically sets the due date to the end of that day. It then builds the full task object by merging your input with metadata, timestamps, and default values (for example, status starts at '0'). The task is inserted into the database, and an audit log entry is triggered to record that it was created.
  • Update task -the system first fetches the task by its ID (and throws an "Invalid ID" error if it can't find it). It prepares the update, and specifically sets a completionDate timestamp if you're marking the status as '5' (Completed). The change is then audited and saved to the database.

5.11 Correspondence Timeline

The Correspondence Timeline is essentially the activity log for a detection. It accepts action, key, value, and keysToExclude as inputs, normalizes the action field first, formats that into a query, and returns the matching logs from the database -giving you a clean, chronological record of everything that's happened on that detection.