{"id":7949,"date":"2026-05-17T06:21:05","date_gmt":"2026-05-17T03:21:05","guid":{"rendered":"http:\/\/mohamed"},"modified":"2026-05-18T14:59:56","modified_gmt":"2026-05-18T11:59:56","slug":"suspicious-users","status":"publish","type":"docs","link":"https:\/\/docs.tawarly.com\/ar\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/suspicious-users\/","title":{"rendered":"Suspicious Users"},"content":{"rendered":"<h2>Overview<\/h2>\n<p>Suspicious Users highlights accounts that may require review based on authentication or activity signals.<\/p>\n<h2>What this feature does<\/h2>\n<p>It helps administrators focus on accounts with unusual patterns such as failed logins, new country access, unusual timing, or sensitive actions.<\/p>\n<h2>Why it is useful<\/h2>\n<ul>\n<li>It helps prioritize investigations by user.<\/li>\n<li>It provides a bridge between authentication data and activity data.<\/li>\n<li>It supports proactive security monitoring.<\/li>\n<\/ul>\n<h2>Who should read this?<\/h2>\n<p>RISE Admin, Security Officer, System Owner.<\/p>\n<h2>Where to find it<\/h2>\n<p>Rise Audit Pro \u2192 Security Dashboard.<\/p>\n<h2>How to use it<\/h2>\n<ol>\n<li>Open Security Dashboard.<\/li>\n<li>Review the Suspicious Users section.<\/li>\n<li>Open the user&#8217;s Auth Log and Activity Log events.<\/li>\n<li>Check whether the behavior is expected.<\/li>\n<li>Document and take action if needed.<\/li>\n<\/ol>\n<h2>Example workflow<\/h2>\n<p>A user appears as suspicious after logging in from a new country and changing several invoices. The security officer reviews the account and confirms whether the activity was authorized.<\/p>\n<h2>Screenshot<\/h2>\n<div class=\"docs-screenshot-required\" style=\"color:#b42318; font-weight:700; background:#fff1f1; border:1px solid #f3b4b4; padding:12px 14px; border-radius:8px; margin:18px 0;\">\n  Screenshot required<br \/>\n  Capture from: Rise Audit Pro \u2192 Security Dashboard \u2192 Suspicious Users\n<\/div>\n<h2>Common mistakes<\/h2>\n<ul>\n<li>Assuming suspicious always means malicious.<\/li>\n<li>Ignoring suspicious users because they are trusted staff.<\/li>\n<li>Not reviewing the underlying events behind the label.<\/li>\n<\/ul>\n<h2>Related articles<\/h2>\n<ul>\n<li>User Risk Scores<\/li>\n<li>How to Investigate a High-Risk User<\/li>\n<li>Investigating Suspicious Login Activity<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Overview Suspicious Users highlights accounts that may require review based on authentication or activity signals. What this feature does It helps administrators focus on accounts with unusual patterns such as failed logins, new country access, unusual timing, or sensitive actions. Why it is useful It helps prioritize investigations by user. It provides a bridge between [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":8281,"menu_order":5,"comment_status":"closed","ping_status":"closed","template":"","doc_tag":[],"doc_badge":[],"class_list":["post-7949","docs","type-docs","status-publish","hentry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Suspicious Users - Tawarly Ltd<\/title>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"ar_AR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Suspicious Users - Tawarly Ltd\" \/>\n<meta property=\"og:description\" content=\"Overview Suspicious Users highlights accounts that may require review based on authentication or activity signals. What this feature does It helps administrators focus on accounts with unusual patterns such as failed logins, new country access, unusual timing, or sensitive actions. Why it is useful It helps prioritize investigations by user. It provides a bridge between [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/docs.tawarly.com\/ar\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/suspicious-users\/\" \/>\n<meta property=\"og:site_name\" content=\"Tawarly Ltd\" \/>\n<meta property=\"article:modified_time\" content=\"2026-05-18T11:59:56+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u0648\u0642\u062a \u0627\u0644\u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u064f\u0642\u062f\u0651\u0631\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u062f\u0642\u064a\u0642\u0629 \u0648\u0627\u062d\u062f\u0629\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/docs\\\/rise-audit-pro-documentation\\\/security-dashboard-and-risk-scores\\\/suspicious-users\\\/\",\"url\":\"https:\\\/\\\/docs.tawarly.com\\\/docs\\\/rise-audit-pro-documentation\\\/security-dashboard-and-risk-scores\\\/suspicious-users\\\/\",\"name\":\"Suspicious Users - Tawarly Ltd\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/#website\"},\"datePublished\":\"2026-05-17T03:21:05+00:00\",\"dateModified\":\"2026-05-18T11:59:56+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/docs\\\/rise-audit-pro-documentation\\\/security-dashboard-and-risk-scores\\\/suspicious-users\\\/#breadcrumb\"},\"inLanguage\":\"ar\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/docs.tawarly.com\\\/docs\\\/rise-audit-pro-documentation\\\/security-dashboard-and-risk-scores\\\/suspicious-users\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/docs\\\/rise-audit-pro-documentation\\\/security-dashboard-and-risk-scores\\\/suspicious-users\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/docs.tawarly.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Rise Audit Pro Documentation\",\"item\":\"https:\\\/\\\/docs.tawarly.com\\\/docs\\\/rise-audit-pro-documentation\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Security Dashboard and Risk Scores\",\"item\":\"https:\\\/\\\/docs.tawarly.com\\\/docs\\\/rise-audit-pro-documentation\\\/security-dashboard-and-risk-scores\\\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Suspicious Users\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/#website\",\"url\":\"https:\\\/\\\/docs.tawarly.com\\\/\",\"name\":\"Tawarly Ltd\",\"description\":\"inspired by the future\",\"publisher\":{\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/docs.tawarly.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"ar\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/#organization\",\"name\":\"Tawarly Ltd\",\"url\":\"https:\\\/\\\/docs.tawarly.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ar\",\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/docs.tawarly.com\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/logo-full.png\",\"contentUrl\":\"https:\\\/\\\/docs.tawarly.com\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/logo-full.png\",\"width\":300,\"height\":81,\"caption\":\"Tawarly Ltd\"},\"image\":{\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Suspicious Users - Tawarly Ltd","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"ar_AR","og_type":"article","og_title":"Suspicious Users - Tawarly Ltd","og_description":"Overview Suspicious Users highlights accounts that may require review based on authentication or activity signals. What this feature does It helps administrators focus on accounts with unusual patterns such as failed logins, new country access, unusual timing, or sensitive actions. Why it is useful It helps prioritize investigations by user. It provides a bridge between [&hellip;]","og_url":"https:\/\/docs.tawarly.com\/ar\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/suspicious-users\/","og_site_name":"Tawarly Ltd","article_modified_time":"2026-05-18T11:59:56+00:00","twitter_card":"summary_large_image","twitter_misc":{"\u0648\u0642\u062a \u0627\u0644\u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u064f\u0642\u062f\u0651\u0631":"\u062f\u0642\u064a\u0642\u0629 \u0648\u0627\u062d\u062f\u0629"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/docs.tawarly.com\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/suspicious-users\/","url":"https:\/\/docs.tawarly.com\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/suspicious-users\/","name":"Suspicious Users - Tawarly Ltd","isPartOf":{"@id":"https:\/\/docs.tawarly.com\/#website"},"datePublished":"2026-05-17T03:21:05+00:00","dateModified":"2026-05-18T11:59:56+00:00","breadcrumb":{"@id":"https:\/\/docs.tawarly.com\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/suspicious-users\/#breadcrumb"},"inLanguage":"ar","potentialAction":[{"@type":"ReadAction","target":["https:\/\/docs.tawarly.com\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/suspicious-users\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/docs.tawarly.com\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/suspicious-users\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/docs.tawarly.com\/"},{"@type":"ListItem","position":2,"name":"Rise Audit Pro Documentation","item":"https:\/\/docs.tawarly.com\/docs\/rise-audit-pro-documentation\/"},{"@type":"ListItem","position":3,"name":"Security Dashboard and Risk Scores","item":"https:\/\/docs.tawarly.com\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/"},{"@type":"ListItem","position":4,"name":"Suspicious Users"}]},{"@type":"WebSite","@id":"https:\/\/docs.tawarly.com\/#website","url":"https:\/\/docs.tawarly.com\/","name":"Tawarly Ltd","description":"inspired by the future","publisher":{"@id":"https:\/\/docs.tawarly.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/docs.tawarly.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ar"},{"@type":"Organization","@id":"https:\/\/docs.tawarly.com\/#organization","name":"Tawarly Ltd","url":"https:\/\/docs.tawarly.com\/","logo":{"@type":"ImageObject","inLanguage":"ar","@id":"https:\/\/docs.tawarly.com\/#\/schema\/logo\/image\/","url":"https:\/\/docs.tawarly.com\/wp-content\/uploads\/2021\/03\/logo-full.png","contentUrl":"https:\/\/docs.tawarly.com\/wp-content\/uploads\/2021\/03\/logo-full.png","width":300,"height":81,"caption":"Tawarly Ltd"},"image":{"@id":"https:\/\/docs.tawarly.com\/#\/schema\/logo\/image\/"}}]}},"author_avatar":"https:\/\/secure.gravatar.com\/avatar\/08585f715052565fc38d5f512ef098033f30c14d4c14becefded93819a77543c?s=96&d=mm&r=g","author_name":"mohamed","_links":{"self":[{"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/docs\/7949","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/comments?post=7949"}],"version-history":[{"count":1,"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/docs\/7949\/revisions"}],"predecessor-version":[{"id":8078,"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/docs\/7949\/revisions\/8078"}],"up":[{"embeddable":true,"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/docs\/8281"}],"wp:attachment":[{"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/media?parent=7949"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/doc_tag?post=7949"},{"taxonomy":"doc_badge","embeddable":true,"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/doc_badge?post=7949"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}