Suspicious User Activity Detection

We have introduced a new feature that enhances the visibility and control over user Suspicious User Activity. This feature helps identify users who access entry points within a site from multiple recurring devices, which may indicate irregular or risky behavior.

Example

• User opens a door within site S using Device A
• The same user opens a door within the same site S using Device B
• Then the same user opens a door within the same site S using Device A

This pattern will automatically flag the user as suspicious.

Where to Access This Feature

You can access the Suspicious User Detection section directly from the site dashboard. It will appear as a chart titled “Users with suspicious device switching”, which gives an overview of users who may require attention.

Understanding the Suspicious Users Chart

In the Suspicious Users section, you will find a dedicated chart specifically designed to highlight user device-switching behavior. This chart is divided into three categories:

1. Users with unresolved device switching
2. Users with resolved past device switching
3. Users flagged as permanently resolved

You can access more details about the users by clicking on a segment of the chart or the corresponding label in the legend.

Next to each user you will see these action buttons:

• Remove User
• Check Logs
• View details
• Resolve (only available for users with unresolved device switching)

Additionally, you can export the user(s) data to a CSV file for further analysis or reporting.

For users in the resolved or permanently resolved categories, the Resolve button will not appear, but you can still check their logs.

Inside the logs, each device used by a user is displayed in a different color, making it easy to understand access patterns and device-switching behavior. You can also export the user’s logs to a CSV file for further analysis or reporting.

Viewing User Details

When you click on the View Details for a given user, the following information will be displayed:

1. Resolutions – Shows the history of resolutions applied to the user, including type, who resolved or unresolved them, and dates.
2. Device Usage Timeline – Displays the user’s device activity, each device is represented by a color, first and last use dates, total commands, and which resolution each device is associated with.

Resolving Suspicious Users (Can be done only by Admins)

Admins can resolve suspicious users in two ways, after entering the “Users with unresolved device switching” segment of the chart (or selecting its corresponding color in the legend):

1. Resolve always – Permanently resolves the user. They will never be flagged again.
2. Resolve for the past – Temporarily resolves the user. If they repeat the switching pattern (A → B → A), they will be flagged again.

After resolving users, the “Users with suspicious device switching” chart updates automatically to reflect the current status of unresolved, temporarily resolved, and permanently resolved users.

Unresolving Users (Can be done only by Admins)

Admins can also reverse a previous resolution. To do this, go to the “Users with resolved past device switching” or “Users flagged as permanently resolved” segments in the chart, and click on a user to view details. There are two types of unresolve actions:

1. Unresolve Latest Resolution
   • Reverts only the most recent resolution applied to the user.
   • Previous resolutions (if any) remain intact.
   • The user may become suspicious again if their device-switching pattern meets the criteria.
2. Unresolve All Resolutions
   • Clears all resolutions for the user, including temporary and permanent ones.
   • The user will be fully treated as unresolved and will appear in the “Users with unresolved device switching” category again.

After unresolving users, the “Users with suspicious device switching” chart updates automatically to reflect the current status of unresolved, temporarily resolved, and permanently resolved users.

Automatic Background Scanning & Alerts Process

Kindoo now runs a background scan every 24 hours to detect users with recent suspicious activity.

If any suspicious activity is detected within the past 48 hours, the system will send an email to the site admins.

Any Kindoo user that is an admin of 1 or multiple sites in Kindoo will receive at most 1 email per day relating to suspicious behaviors. This email will include a recap of all their sites that have suspicious users that are unresolved with last access date and total number of suspicious users in each site.