Changelog

Today we're launching another improvement to the time selector in the Castle dashboard: the ability to pin the selected time range so that it is retained when navigating between views. This is useful to lock the time when e.g. investigating credential stuffing attacks or spikes in traffic, and jumping between the Explore view to slice the data in different ways, and the individual user profiles to do the final confirmation.

For some time now, you've been able to use the visualization in the Explore view to zoom in on a specific time range by dragging the mouse. This is especially useful to zoom in on spikes of traffic, such as credential stuffing attacks. However, a common pattern is that you often also want to be able go back and extend the selected time range without having to manually specify a new start and end time. Today we're introducing a way to do this with a single click: a button next to the time picker to "zoom out" time. Each time you press it you'll double the selected time range

The user profile view is central to do per-user investigations as you'll get a comprehensive view of an account, with all important information in one place. Today we've updated this view with the ability to create group tabs, in the same flexible way as in the Explore view. This means that you're now able to quickly see all the user's transactions, IPs, device types or anything else available in the Castle event format. Similarly to the Explore view, this also works with custom properties

We've improved the filter drop down to make Signals and Lists more prominent, which allows for quicker navigation and exploration or these. Signals are a great way to start exploring your data to find suspicious patterns, such as VPN usage or credential stuffing, and with the improved filter drop down you'll get a much better overview of the available Signals. Similarly, with the improved Lists filter, you're quickly able to find historic data that matched a specific list

Lists are a powerful concept in Castle that allows you to manage state in a general way, which is useful for anything from keeping track of Trusted Devices that will auto expire after some time, to maintaining an IP block list.

Lately, we've been spending some time to make transactions a first class citizen in Castle, and now we've shipped two updates to our APIs that allows sending more information about transactions, to better help you spot suspicious ones.

Castle supports tracking address information, both on the user and transaction object in the API payload. You're able to send all the common fields like street address, city, region and postal code. When sending this information, Castle computes a fingerprint by normalizing the address information and creating a hash. This makes it super easy to find e.g. multiple users on the same address, or when using the same shipping address for multiple payment methods. Today we're introducing a change in the API which allows you to send your own address fingerprint if you prefer a custom one over the one that Castle computes automatically.

Castle allows you to send rich transaction data such as payment amount, method, fingerprint and much more. With this information available in Castle you're able to search historic transactions, spot fraudulent ones and then write rules to either block them or warn you when these happen.

Today we've launched a powerful new way of visualizing data over time across many entities of the same type, like Users, Devices or IPs. With this feature, you can quickly hone in on suspicious users, and compare their activity over time, to discover patterns indicative of e.g. multi-accounting abuse. By seeing user activity next to each other, you're able to spot clusters of account with similarities in event sequences, such as a signup shortly followed by an invitation.

Today we're proud to release our link analysis feature which empowers you to quickly visualize and discover more fraudulent users. Link analysis is a powerful technique used to identify relationships and connections between entities such as users, devices, addresses, payment methods and more. Finding such connections can reveal fraudulent patterns and anomalies such as: