Incidents group elevated activity so you can review what happened and decide whether to tighten rules or enable Shield.
When incidents open
The detection engine scores order-derived signals. When scores or patterns cross configured thresholds, CheckoutGuard can open an incident (for example OPEN or MONITORING). Quiet stores may have few or no incidents — that can be normal.
How to respond
- Read the incident title, severity, and related events
- Decide whether Monitor-only is enough or Shield should be on
- Tune or disable rules that catch legitimate buyers
Alerts
Unread alerts appear on the Dashboard. Use them as a triage inbox, not as proof of confirmed fraud.