---
module: aria.precursor-alerts
title: Precursor Alerts
tab: Customer
order: 10
audience: customer
---

Precursor Alerts flags devices where a series of warning signs points to an attack building up — such as the early steps of jackpotting (cash-out) or card skimming. Use this screen to spot these multi-step patterns early, review what happened, and clear each alert once your team has looked into it.

## 🔎 What you can do here
- **Scan active alerts** — the list opens showing alerts that still need attention.
- **Open the filters** using the ▶ arrow on the left, then narrow the list by:
  - **Device ID** — type a device to see only its alerts.
  - **Status** — Active, Resolved, or All.
  - **Type** — Jackpotting, Skimming, or Unknown.
- **Clear all** filters at once with the ✕ button, or remove one at a time using the filter chips above the table.
- **View the details** — click any row (or the **Events** button) to open a side panel showing every warning signal that made up the sequence.
- **Resolve an alert** — click **Resolve** on a row, or **Mark Resolved** in the detail panel, once it's been reviewed or handled.
- **Auto-refresh** keeps the list current on its own; the toggle in the top-right lets you turn it off, and the ↻ button refreshes on demand.

## 📊 What you're looking at
Each row is one detected sequence:
- **Type** — the kind of attack the pattern suggests: 💰 Jackpotting, 💳 Skimming, or ❓ Unknown.
- **Device** — the ATM or device where the pattern was seen.
- **Phases Detected** — the stages of the attack that were spotted, shown as chips.
- **Confidence** — how strongly the signs point to a real attack, shown as a bar and percentage. Green is lower confidence, orange is medium, and red is high.
- **Triggered** — when the pattern was first flagged.
- **Status** — **Active** (needs attention) or **Resolved** (already handled).

Open the detail panel to see the individual **Events in Sequence** — each warning signal, its attack phase, when it was detected, and how severe it was.

## 💡 Good to know
- A higher confidence percentage means more of the tell-tale steps lined up — treat red, high-confidence alerts as most urgent.
- Resolving an alert records who cleared it and moves it out of the Active list; you can always switch Status to **Resolved** or **All** to review past alerts.
