{"id":7979,"date":"2026-05-17T06:21:06","date_gmt":"2026-05-17T03:21:06","guid":{"rendered":"http:\/\/mohamed"},"modified":"2026-05-18T14:59:56","modified_gmt":"2026-05-18T11:59:56","slug":"how-to-investigate-a-high-risk-user","status":"publish","type":"docs","link":"https:\/\/docs.tawarly.com\/ar\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/how-to-investigate-a-high-risk-user\/","title":{"rendered":"How to Investigate a High-Risk User"},"content":{"rendered":"<h2>Overview<\/h2>\n<p>A high-risk user investigation should combine user risk score details, authentication logs, activity logs, session timeline, and security dashboard signals.<\/p>\n<h2>What this feature does<\/h2>\n<p>It gives administrators a step-by-step process to review user activity without relying on one signal alone.<\/p>\n<h2>Why it is useful<\/h2>\n<ul>\n<li>It reduces false positives.<\/li>\n<li>It helps confirm compromised accounts faster.<\/li>\n<li>It gives teams a repeatable investigation workflow.<\/li>\n<\/ul>\n<h2>Who should read this?<\/h2>\n<p>RISE Admin, Security Officer, System Owner.<\/p>\n<h2>Where to find it<\/h2>\n<p>Rise Audit Pro \u2192 User Risk Scores, Auth Log, Activity Log, Security Dashboard, Session Timeline.<\/p>\n<h2>How to use it<\/h2>\n<ol>\n<li>Open User Risk Scores.<\/li>\n<li>Select the high-risk user.<\/li>\n<li>Review the risk factors.<\/li>\n<li>Open Auth Log for login context.<\/li>\n<li>Open Activity Log for sensitive changes.<\/li>\n<li>Review Session Timeline for the sequence of actions.<\/li>\n<li>Confirm with the user or manager if needed.<\/li>\n<li>Take action according to your security policy.<\/li>\n<\/ol>\n<h2>Example workflow<\/h2>\n<p>A high-risk user shows new country login and bulk deletion activity. The security officer reviews the session timeline, confirms the user did not perform the actions, and disables the account pending investigation.<\/p>\n<h2>Recommended investigation checklist<\/h2>\n<ul>\n<li>What risk factors triggered the score?<\/li>\n<li>Was the login source expected?<\/li>\n<li>Did sensitive actions happen after the login?<\/li>\n<li>Is the user able to confirm the activity?<\/li>\n<li>Do permissions need to be reduced or credentials reset?<\/li>\n<li>Should the event be documented for compliance?<\/li>\n<\/ul>\n<h2>Screenshot<\/h2>\n<div class=\"docs-screenshot-required\" style=\"color:#b42318; font-weight:700; background:#fff1f1; border:1px solid #f3b4b4; padding:12px 14px; border-radius:8px; margin:18px 0;\">\n  Screenshot required<br \/>\n  Capture from: Rise Audit Pro \u2192 User Risk Scores \u2192 High risk user details\n<\/div>\n<h2>Common mistakes<\/h2>\n<ul>\n<li>Taking action without reviewing supporting evidence.<\/li>\n<li>Ignoring high-risk users because they are senior staff.<\/li>\n<li>Not preserving exports or notes for serious investigations.<\/li>\n<\/ul>\n<h2>Related articles<\/h2>\n<ul>\n<li>User Risk Scores<\/li>\n<li>Session Timeline<\/li>\n<li>Activity Log Overview<\/li>\n<li>Auth Log Overview<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Overview A high-risk user investigation should combine user risk score details, authentication logs, activity logs, session timeline, and security dashboard signals. What this feature does It gives administrators a step-by-step process to review user activity without relying on one signal alone. Why it is useful It reduces false positives. It helps confirm compromised accounts faster. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":8281,"menu_order":12,"comment_status":"closed","ping_status":"closed","template":"","doc_tag":[],"doc_badge":[],"class_list":["post-7979","docs","type-docs","status-publish","hentry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to Investigate a High-Risk User - Tawarly Ltd<\/title>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"ar_AR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Investigate a High-Risk User - Tawarly Ltd\" \/>\n<meta property=\"og:description\" content=\"Overview A high-risk user investigation should combine user risk score details, authentication logs, activity logs, session timeline, and security dashboard signals. What this feature does It gives administrators a step-by-step process to review user activity without relying on one signal alone. Why it is useful It reduces false positives. It helps confirm compromised accounts faster. [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/docs.tawarly.com\/ar\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/how-to-investigate-a-high-risk-user\/\" \/>\n<meta property=\"og:site_name\" content=\"Tawarly Ltd\" \/>\n<meta property=\"article:modified_time\" content=\"2026-05-18T11:59:56+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u0648\u0642\u062a \u0627\u0644\u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u064f\u0642\u062f\u0651\u0631\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u062f\u0642\u064a\u0642\u0629 \u0648\u0627\u062d\u062f\u0629\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/docs\\\/rise-audit-pro-documentation\\\/security-dashboard-and-risk-scores\\\/how-to-investigate-a-high-risk-user\\\/\",\"url\":\"https:\\\/\\\/docs.tawarly.com\\\/docs\\\/rise-audit-pro-documentation\\\/security-dashboard-and-risk-scores\\\/how-to-investigate-a-high-risk-user\\\/\",\"name\":\"How to Investigate a High-Risk User - Tawarly Ltd\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/#website\"},\"datePublished\":\"2026-05-17T03:21:06+00:00\",\"dateModified\":\"2026-05-18T11:59:56+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/docs\\\/rise-audit-pro-documentation\\\/security-dashboard-and-risk-scores\\\/how-to-investigate-a-high-risk-user\\\/#breadcrumb\"},\"inLanguage\":\"ar\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/docs.tawarly.com\\\/docs\\\/rise-audit-pro-documentation\\\/security-dashboard-and-risk-scores\\\/how-to-investigate-a-high-risk-user\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/docs\\\/rise-audit-pro-documentation\\\/security-dashboard-and-risk-scores\\\/how-to-investigate-a-high-risk-user\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/docs.tawarly.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Rise Audit Pro Documentation\",\"item\":\"https:\\\/\\\/docs.tawarly.com\\\/docs\\\/rise-audit-pro-documentation\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Security Dashboard and Risk Scores\",\"item\":\"https:\\\/\\\/docs.tawarly.com\\\/docs\\\/rise-audit-pro-documentation\\\/security-dashboard-and-risk-scores\\\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"How to Investigate a High-Risk User\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/#website\",\"url\":\"https:\\\/\\\/docs.tawarly.com\\\/\",\"name\":\"Tawarly Ltd\",\"description\":\"inspired by the future\",\"publisher\":{\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/docs.tawarly.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"ar\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/#organization\",\"name\":\"Tawarly Ltd\",\"url\":\"https:\\\/\\\/docs.tawarly.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ar\",\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/docs.tawarly.com\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/logo-full.png\",\"contentUrl\":\"https:\\\/\\\/docs.tawarly.com\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/logo-full.png\",\"width\":300,\"height\":81,\"caption\":\"Tawarly Ltd\"},\"image\":{\"@id\":\"https:\\\/\\\/docs.tawarly.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Investigate a High-Risk User - Tawarly Ltd","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"ar_AR","og_type":"article","og_title":"How to Investigate a High-Risk User - Tawarly Ltd","og_description":"Overview A high-risk user investigation should combine user risk score details, authentication logs, activity logs, session timeline, and security dashboard signals. What this feature does It gives administrators a step-by-step process to review user activity without relying on one signal alone. Why it is useful It reduces false positives. It helps confirm compromised accounts faster. [&hellip;]","og_url":"https:\/\/docs.tawarly.com\/ar\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/how-to-investigate-a-high-risk-user\/","og_site_name":"Tawarly Ltd","article_modified_time":"2026-05-18T11:59:56+00:00","twitter_card":"summary_large_image","twitter_misc":{"\u0648\u0642\u062a \u0627\u0644\u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u064f\u0642\u062f\u0651\u0631":"\u062f\u0642\u064a\u0642\u0629 \u0648\u0627\u062d\u062f\u0629"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/docs.tawarly.com\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/how-to-investigate-a-high-risk-user\/","url":"https:\/\/docs.tawarly.com\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/how-to-investigate-a-high-risk-user\/","name":"How to Investigate a High-Risk User - Tawarly Ltd","isPartOf":{"@id":"https:\/\/docs.tawarly.com\/#website"},"datePublished":"2026-05-17T03:21:06+00:00","dateModified":"2026-05-18T11:59:56+00:00","breadcrumb":{"@id":"https:\/\/docs.tawarly.com\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/how-to-investigate-a-high-risk-user\/#breadcrumb"},"inLanguage":"ar","potentialAction":[{"@type":"ReadAction","target":["https:\/\/docs.tawarly.com\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/how-to-investigate-a-high-risk-user\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/docs.tawarly.com\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/how-to-investigate-a-high-risk-user\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/docs.tawarly.com\/"},{"@type":"ListItem","position":2,"name":"Rise Audit Pro Documentation","item":"https:\/\/docs.tawarly.com\/docs\/rise-audit-pro-documentation\/"},{"@type":"ListItem","position":3,"name":"Security Dashboard and Risk Scores","item":"https:\/\/docs.tawarly.com\/docs\/rise-audit-pro-documentation\/security-dashboard-and-risk-scores\/"},{"@type":"ListItem","position":4,"name":"How to Investigate a High-Risk User"}]},{"@type":"WebSite","@id":"https:\/\/docs.tawarly.com\/#website","url":"https:\/\/docs.tawarly.com\/","name":"Tawarly Ltd","description":"inspired by the future","publisher":{"@id":"https:\/\/docs.tawarly.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/docs.tawarly.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ar"},{"@type":"Organization","@id":"https:\/\/docs.tawarly.com\/#organization","name":"Tawarly Ltd","url":"https:\/\/docs.tawarly.com\/","logo":{"@type":"ImageObject","inLanguage":"ar","@id":"https:\/\/docs.tawarly.com\/#\/schema\/logo\/image\/","url":"https:\/\/docs.tawarly.com\/wp-content\/uploads\/2021\/03\/logo-full.png","contentUrl":"https:\/\/docs.tawarly.com\/wp-content\/uploads\/2021\/03\/logo-full.png","width":300,"height":81,"caption":"Tawarly Ltd"},"image":{"@id":"https:\/\/docs.tawarly.com\/#\/schema\/logo\/image\/"}}]}},"author_avatar":"https:\/\/secure.gravatar.com\/avatar\/08585f715052565fc38d5f512ef098033f30c14d4c14becefded93819a77543c?s=96&d=mm&r=g","author_name":"mohamed","_links":{"self":[{"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/docs\/7979","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/comments?post=7979"}],"version-history":[{"count":1,"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/docs\/7979\/revisions"}],"predecessor-version":[{"id":8041,"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/docs\/7979\/revisions\/8041"}],"up":[{"embeddable":true,"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/docs\/8281"}],"wp:attachment":[{"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/media?parent=7979"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/doc_tag?post=7979"},{"taxonomy":"doc_badge","embeddable":true,"href":"https:\/\/docs.tawarly.com\/ar\/wp-json\/wp\/v2\/doc_badge?post=7979"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}