---
module: aria.threat-events
title: Threat Events
tab: Customer
order: 10
audience: customer
---

A running list of suspicious activity HiveIQ has spotted across your ATM fleet. Use this screen to see what was detected, how serious it is, and which device it happened on.

## 🔎 What you can do here
1. **Browse detected events** — the newest activity across your fleet appears at the top.
2. **Filter by severity** — open the **Filters** panel and pick a severity (Critical, High, Medium, Low, or Info) to focus on what matters most.
3. **Search by device** — type a Device (Agent) ID in the Filters panel to see events for one machine.
4. **Clear filters** — use **Clear all** to return to the full list.
5. **Stay current** — the list auto-refreshes every 60 seconds. Toggle **Auto-refresh** off if you'd rather it hold still, or press the **↻ refresh** button to update on demand.

> The counter next to the Filters panel and in the toolbar shows how many events match your current view.

## 📋 What you're looking at
Each row is one detected event:

- **Severity** — how serious it is, from Critical down to Info.
- **Signal** — a short description of the behavior that was flagged.
- **Device** — the ATM (Agent ID) where it was detected.
- **Attack Phase** — where the activity fits in a typical attack: Physical Access, Staging, Execution, Persistence, or Cleanup.
- **IOC Match** — the known threat indicator that was matched, along with its type.
- **Detected** — when the event was seen.

## 💡 Good to know
- Sort your attention by **severity** first — Critical and High events are the ones worth acting on right away.
- The **Attack Phase** helps you gauge how far along a threat may be; earlier phases (Physical Access, Staging) are warning signs, later ones (Execution, Persistence, Cleanup) need urgent follow-up.
